Cross-source coverage

T1538 / ATT&CK

Cloud Service Dashboard

4 rules across 4 sources.

From MITRE ATT&CK 19.2

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.

Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.

Tactics
Discovery
Platforms
IaaS · SaaS · Office Suite · Identity Provider
Telemetry
AWS:CloudTrailazure:signinlogssaas:oktam365:signinlogsm365:unifiedsaas:zoomsaas:salesforcesaas:box

How MITRE says to detect it DET0291

Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access

IaaS Analytic 0808

Detects web console login events followed by read-only or metadata retrieval activity from GUI sources (e.g., browser session, mobile client) rather than API/CLI sources. Correlates across CloudTrail, IAM identity logs, and user-agent context.

  • AWS:CloudTrail ConsoleLogin
  • AWS:CloudTrail Post-authentication metadata enumeration from GUI session

Identity Provider Analytic 0809

Detects successful login to cloud identity portals (e.g., Okta, Azure AD, Google Identity) from atypical geolocations, devices, or user agents immediately followed by dashboard/portal navigation to sensitive pages such as user or app configuration.

  • azure:signinlogs Sign-in with unfamiliar location/device + portal navigation
  • saas:okta user.session.start
  • saas:okta WebUI access to administrator dashboard

Office Suite Analytic 0810

Detects login to admin consoles (e.g., Microsoft 365 Admin Center) from unrecognized users, devices, or geolocations followed by non-API data review or configuration read actions that suggest GUI dashboard use.

  • m365:signinlogs UserLoginSuccess
  • m365:unified ViewAdminReport
  • m365:unified Read-only configuration review from GUI

SaaS Analytic 0811

Detects SaaS web login followed by dashboard or web GUI page views from unfamiliar locations, devices, or access patterns. Identifies use of sensitive reporting or configuration consoles accessed from high-risk accounts.

  • saas:zoom Zoom Admin Dashboard accessed from unfamiliar IP/device
  • saas:salesforce Login
  • saas:box User navigated to admin interface

View on attack.mitre.org ↗

elastic/detection-rules

1 rule
Detection Severity Format
AWS SSM Inventory Reconnaissance by Rare User Medium Elastic TOML

panther-labs/panther-analysis

1 rule
Detection Severity Format
A CloudTrail Was Created or Updated Informational Panther Python

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
operation. · office_365.Operation = HeartBeat Low Wazuh XML

splunk/security_content

1 rule
Detection Severity Format
Okta Multiple Failed Requests to Access Applications Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.