Cloud Account
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365. The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain. The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix. In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1087
Enumeration of identity roles and users via API calls such as Get-MsolRoleMember, az ad user list, or Graph API tokens from unauthorized users or automation accounts.
- AN1088
Use of AWS CLI (aws iam list-users, list-roles), Azure CLI (az ad user list), or GCP CLI (gcloud iam service-accounts list) from endpoints or cloud shells where such activity is unexpected.
- AN1089
Bulk enumeration of cloud user email identities through Get-Recipient, Get-Mailbox, Get-User, or Graph API directory listings by abnormal accounts or suspicious sessions.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.