Cross-source coverage

T1021.007 / ATT&CK

Remote Services: Cloud Services

18 rules · 17 families across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.

Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., Cloud API), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.

In some cases, adversaries may be able to authenticate to these services via Application Access Token instead of a username and password.

Platforms
IaaS · Identity Provider · Office Suite · SaaS
Telemetry
AWS:CloudTrailgcp:auditOkta:SystemLogm365:unifiedsaas:auth

How MITRE says to detect it DET0008

Behavioral Detection of Remote Cloud Logins via Valid Accounts

IaaS Analytic 0017

Cloud login from atypical geolocation or user-agent string, followed by resource enumeration or infrastructure manipulation using cloud CLI/API

  • AWS:CloudTrail ConsoleLogin, AssumeRole, ListResources
  • gcp:audit None

Identity Provider Analytic 0018

Federated login using SSO or OAuth grant to cloud control plane, followed by directory or permissions enumeration

  • Okta:SystemLog user.authentication.sso, app.oauth.grant

Office Suite Analytic 0019

Login to M365 or Google Workspace from CLI tools or unexpected source IPs, followed by mailbox or document access

  • m365:unified FileAccessed, MailboxAccessed
  • m365:unified UserLoggedIn

SaaS Analytic 0020

Remote access to third-party SaaS with OAuth or API tokens post-initial compromise, followed by sensitive data access or configuration changes

  • saas:auth LoginSuccess, APIKeyUse, AdminAction

View on attack.mitre.org ↗

elastic/detection-rules

6 rules
Detection Severity Format
AWS EC2 Instance Console Login via Assumed Role High Elastic TOML
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity High Elastic TOML
AWS SSM Session Started to EC2 Instance High Elastic TOML
Unusual AWS Command for a User Low Elastic TOML
Unusual Azure Activity Logs Event for a User Low Elastic TOML
Unusual GCP Event for a User Low Elastic TOML

panther-labs/panther-analysis

5 rules
Detection Severity Format
Kubernetes System Principal Accessed from Non-Cloud Public IP High Panther Python
MongoDB access allowed from anywhere High Panther Python
AWS Console GetSigninToken Potential Abuse Medium Panther Python
Intune Create or Modify Client App Medium Panther Python
Intune New Device Management Script Medium Panther Python

splunk/security_content

5 rules
Detection Severity Format
Microsoft Intune Device Health Scripts Undefined SPL
Microsoft Intune DeviceManagementConfigurationPolicies Undefined SPL
Microsoft Intune Manual Device Management Undefined SPL
Microsoft Intune Mobile Apps Undefined SPL
Windows Azure PowerShell Module Installation Via PowerShell Script Undefined SPL

SigmaHQ/sigma

1 rule
Detection Severity Format
AWS Console GetSigninToken Potential Abuse Medium Sigma

chronicle/detection-rules

1 rule
Detection Severity Format
o365_persistent_login_activity_to_azure_ADPowerShell_app Medium YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.