Cross-source coverage

T1087.004 / ATT&CK

Account Discovery: Cloud Account

27 rules · 26 families across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365. The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.

The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix. In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.

Tactics
Discovery
Platforms
IaaS · Identity Provider · Office Suite · SaaS
Telemetry
Microsoft Entra ID Audit Logsazure:signinlogsm365:defenderAWS:CloudTrailazure:activityWinEventLog:PowerShellMicrosoft Graph API LogsGoogle Admin Auditsaas:okta

How MITRE says to detect it DET0386

Cloud Account Enumeration via API, CLI, and Scripting Interfaces

Identity Provider Analytic 1087

Enumeration of identity roles and users via API calls such as `Get-MsolRoleMember`, `az ad user list`, or Graph API tokens from unauthorized users or automation accounts.

  • Microsoft Entra ID Audit Logs RoleManagement.Read.Directory or Directory.Read.All
  • azure:signinlogs Interactive/Non-Interactive Sign-In
  • m365:defender Activity Log: Command Invocation

IaaS Analytic 1088

Use of AWS CLI (`aws iam list-users`, `list-roles`), Azure CLI (`az ad user list`), or GCP CLI (`gcloud iam service-accounts list`) from endpoints or cloud shells where such activity is unexpected.

  • AWS:CloudTrail AWS IAM: ListUsers, ListRoles
  • azure:activity Azure CLI Operation: Microsoft.Graph/users/read

Office Suite Analytic 1089

Bulk enumeration of cloud user email identities through `Get-Recipient`, `Get-Mailbox`, `Get-User`, or Graph API directory listings by abnormal accounts or suspicious sessions.

  • WinEventLog:PowerShell CmdletName: Get-Recipient, Get-User
  • Microsoft Graph API Logs users.list, directoryObjects.getByIds

SaaS Analytic 1090

Access to organizational directories via Google Workspace Directory API, Slack SCIM, or Okta SCIM by apps or identities outside normal roles.

  • Google Admin Audit users.list, groups.list
  • saas:okta System API Call: user.read, group.read

View on attack.mitre.org ↗

elastic/detection-rules

13 rules
Detection Severity Format
Azure AD Graph Access with Suspicious User-Agent High Elastic TOML
Azure AD Graph Potential Enumeration (ROADrecon) High Elastic TOML
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration High Elastic TOML
Entra ID Sign-in BloodHound Suite User-Agent Detected High Elastic TOML
Entra ID Sign-in TeamFiltration User-Agent Detected High Elastic TOML
AWS EC2 Role GetCallerIdentity from New Source AS Organization Medium Elastic TOML
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy Medium Elastic TOML
AWS STS GetCallerIdentity API Called for the First Time Medium Elastic TOML
Azure AD Graph Access with Unusual Client and User Medium Elastic TOML
Azure AD Graph High 4xx Error Ratio from User Medium Elastic TOML

+ 3 more from elastic/detection-rules → showing the 10 highest-severity

Bert-JanP/Hunting-Queries-Detection-Rules

5 rules · 4 families
Detection Severity Format
AzureHound Detection 2 variants Undefined KQL
AzureHound Detection 2 variants Undefined KQL
Encoded Powershell Commands That Have Potentially Performed Recon Activities Undefined KQL
MITRE ATT&CK Mapping Undefined KQL
Operation download all users in Azure Active directory performed Undefined KQL

splunk/security_content

4 rules
Detection Severity Format
Azure AD AzureHound UserAgent Detected Undefined SPL
Azure AD Service Principal Enumeration Undefined SPL
Okta IDP Lifecycle Modifications Undefined SPL
Okta Unauthorized Access to Application Undefined SPL

SigmaHQ/sigma

3 rules
Detection Severity Format
Discovery Using AzureHound High Sigma
AWS STS GetCallerIdentity Enumeration Via TruffleHog Medium Sigma
RBAC Permission Enumeration Attempt Low Sigma

panther-labs/panther-analysis

2 rules
Detection Severity Format
AWS STS GetCallerIdentity via TruffleHog Medium Panther Python
Azure Key Vault Key Accessed or Recovered Medium Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.