{"id":"T1069.003","name":"Cloud Groups","url":"https://attack.mitre.org/techniques/T1069/003","tactics":["discovery"],"platforms":["SaaS","IaaS","Office Suite","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0251","stix_id":"x-mitre-detection-strategy--55e10a13-d18d-4ce5-a773-c4ec6bd68d52","name":"Behavioral Detection of Cloud Group Enumeration via API and CLI Access","url":"https://attack.mitre.org/detectionstrategies/DET0251","analytics":[{"id":"AN0695","stix_id":"x-mitre-analytic--ef4f995e-6f20-42b7-802e-555ac54ab7b9","name":"Analytic 0695","description":"Detects adversarial use of cloud-native APIs (e.g., AWS IAM, Azure RBAC, GCP Identity) to enumerate cloud group memberships or policy mappings via unauthorized sessions or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0251#AN0695","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"ListGroups, ListAttachedRolePolicies","data_component":"DC0099","data_component_name":"Group Enumeration","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"UserContext","description":"Scope to anomalous IAM principals or assume-role usage."},{"field":"TimeWindow","description":"Correlate enumeration activity within lateral movement prep windows."}],"live":true,"detection_strategies":["DET0251"],"techniques":["T1069.003"]},{"id":"AN0696","stix_id":"x-mitre-analytic--bb94692e-e73c-449c-a17e-0658bebbfd93","name":"Analytic 0696","description":"Identifies unauthorized access or enumeration of administrative roles, security groups, or distribution groups via Exchange/SharePoint/Teams APIs or role discovery scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0251#AN0696","platforms":["Office Suite"],"log_source_references":[{"name":"m365:exchange","channel":"Get-RoleGroup, Get-DistributionGroup","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"m365-exchange"},{"name":"m365:sharepoint","channel":"Enumerate ACLs/role bindings","data_component":"DC0105","data_component_name":"Group Metadata","log_source_slug":"m365-sharepoint"}],"mutable_elements":[{"field":"AccessScope","description":"Adjust based on tenant-level vs. site-level group visibility."},{"field":"ScriptExecutionContext","description":"Detect script-based role listing (e.g., Graph API call chains)."}],"live":true,"detection_strategies":["DET0251"],"techniques":["T1069.003"]},{"id":"AN0697","stix_id":"x-mitre-analytic--54ae99be-c089-4e96-97f5-52af2892ae25","name":"Analytic 0697","description":"Monitors API calls and service-specific logs for enumeration of organizational roles, permissions, and group structure, particularly outside of normal admin behavior baselines.","url":"https://attack.mitre.org/detectionstrategies/DET0251#AN0697","platforms":["SaaS"],"log_source_references":[{"name":"saas:salesforce","channel":"GET /services/data/vXX.X/groups","data_component":"DC0099","data_component_name":"Group Enumeration","log_source_slug":"saas-salesforce"}],"mutable_elements":[{"field":"OrgScope","description":"Scope to cross-team access or unfamiliar org enumeration."},{"field":"RequestRate","description":"Tuning for excessive group-list API calls."}],"live":true,"detection_strategies":["DET0251"],"techniques":["T1069.003"]}],"live":true,"version":"1.0","techniques":["T1069.003"]}],"sigma_rules":[{"id":"84b777bd-c946-4d17-aa2e-c39f5a454325","title":"RBAC Permission Enumeration Attempt","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":null,"description":"Detects identities attempting to enumerate their Kubernetes RBAC permissions.\nIn the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.\nIn a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a \"kubectl auth can-i --list\" command.\nThis will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.\n","references":["https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1069.003","attack.t1087.004","attack.discovery"],"path":"rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml","techniques":["T1069.003","T1087.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}