MITRE ATT&CK technique · Discovery

`T1087.004` Cloud Account

Sub-technique of T1087 Account Discovery

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Mini Shai-Hulud

Sigma rules to hunt it

Discovery Using AzureHoundhightest · azure
AWS STS GetCallerIdentity Enumeration Via TruffleHogmediumexperimental · aws

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.