MITRE ATT&CKsub-technique
T1087.004 Cloud Account
- Domain
- enterprise
- Tactics
- Discovery
- Platforms
- IaaS, Identity Provider, Office Suite, SaaS
- Version
- 1.3
- Created
- 2020-02-21
Description
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365. The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.
The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix. In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1087 Account Discovery technique
Tactic · MITRE ATT&CK (1)
- TA0007 Discovery tactic
Referenced by MITRE ATT&CK · mitigates (2)
Referenced by MITRE ATT&CK · uses (7)
Referenced by Compliance · mitigates (7)
- CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
- NIST-AC-2 Account Management NIST 800-53 control
- NIST-AC-3 Access Enforcement NIST 800-53 control
- NIST-AC-5 Separation of Duties NIST 800-53 control
- NIST-AC-6 Least Privilege NIST 800-53 control
- NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
- NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
References
- https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html AWS List Roles
- https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html AWS List Users
- https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/ Black Hills Red Teaming MS AD Azure, 2018
- https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list Google Cloud - IAM Servie Accounts List API
- https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest Microsoft AZ CLI
- https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0 Microsoft msolrolemember
- https://github.com/True-Demon/raindance GitHub Raindance