cyberstrikeus T1087.004 Cloud Account
Sub-technique of: T1087
High-Level Description
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365. The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.
The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix. In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.
Kill Chain Phase
- Discovery (TA0007)
Platforms: IaaS, Identity Provider, Office Suite, SaaS
What to Check
- Identify if Cloud Account technique is applicable to target environment
- Check IaaS systems for indicators of Cloud Account
- Check Identity Provider systems for indicators of Cloud Account
- Check Office Suite systems for indicators of Cloud Account
- Verify mitigations are bypassed or absent (2 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to Cloud Account by examining the target platforms (IaaS, Identity Provider, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1087.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
M1047 Audit
Routinely check user permissions to ensure only the expected users have the ability to list IAM identities or otherwise discover cloud accounts.
M1018 User Account Management
Limit permissions to discover cloud accounts in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.
Detection
Cloud Account Enumeration via API, CLI, and Scripting Interfaces
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Cloud Account technique applicable | Low | Discovery |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |