{"id":"T1087.004","name":"Cloud Account","url":"https://attack.mitre.org/techniques/T1087/004","tactics":["discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0386","stix_id":"x-mitre-detection-strategy--880c0a88-bbd5-4d71-b8bd-72fbab7d58b2","name":"Cloud Account Enumeration via API, CLI, and Scripting Interfaces","url":"https://attack.mitre.org/detectionstrategies/DET0386","analytics":[{"id":"AN1087","stix_id":"x-mitre-analytic--f74ce996-0982-4e2a-86ee-5bce001ee9fc","name":"Analytic 1087","description":"Enumeration of identity roles and users via API calls such as `Get-MsolRoleMember`, `az ad user list`, or Graph API tokens from unauthorized users or automation accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0386#AN1087","platforms":["Identity Provider"],"log_source_references":[{"name":"Microsoft Entra ID Audit Logs","channel":"RoleManagement.Read.Directory or Directory.Read.All","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"microsoft-entra-id-audit-logs"},{"name":"azure:signinlogs","channel":"Interactive/Non-Interactive Sign-In","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"},{"name":"m365:defender","channel":"Activity Log: Command Invocation","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"m365-defender"}],"mutable_elements":[{"field":"TokenScope","description":"Flags excessive or abnormal use of directory read scopes by unexpected principals."},{"field":"AppContext","description":"Differentiate authorized automation from rogue access tokens or external tools."},{"field":"TimeWindow","description":"Trigger correlation across short bursts of high-volume enumeration."}],"live":true,"detection_strategies":["DET0386"],"techniques":["T1087.004"]},{"id":"AN1088","stix_id":"x-mitre-analytic--3d124174-1e58-44e2-9f5b-f63394fb7a2e","name":"Analytic 1088","description":"Use of AWS CLI (`aws iam list-users`, `list-roles`), Azure CLI (`az ad user list`), or GCP CLI (`gcloud iam service-accounts list`) from endpoints or cloud shells where such activity is unexpected.","url":"https://attack.mitre.org/detectionstrategies/DET0386#AN1088","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"AWS IAM: ListUsers, ListRoles","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"aws-cloudtrail"},{"name":"azure:activity","channel":"Azure CLI Operation: Microsoft.Graph/users/read","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"azure-activity"}],"mutable_elements":[{"field":"CallerType","description":"Suppress known admin accounts and alert on developer/test/service identities."},{"field":"CLIUserAgent","description":"Correlate unexpected CLI user-agents and geolocation anomalies."},{"field":"CloudRegion","description":"Suppress noise from known IP ranges or whitelisted accounts per region."}],"live":true,"detection_strategies":["DET0386"],"techniques":["T1087.004"]},{"id":"AN1089","stix_id":"x-mitre-analytic--0961ff0c-8c36-4820-948d-12855b7f5cc7","name":"Analytic 1089","description":"Bulk enumeration of cloud user email identities through `Get-Recipient`, `Get-Mailbox`, `Get-User`, or Graph API directory listings by abnormal accounts or suspicious sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0386#AN1089","platforms":["Office Suite"],"log_source_references":[{"name":"WinEventLog:PowerShell","channel":"CmdletName: Get-Recipient, Get-User","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"Microsoft Graph API Logs","channel":"users.list, directoryObjects.getByIds","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"microsoft-graph-api-logs"}],"mutable_elements":[{"field":"CmdletVolume","description":"Tune threshold for recipient/mailbox queries by volume per hour."},{"field":"UserAgent","description":"Match known admin consoles and exclude sanctioned tools like MSOL PowerShell."},{"field":"SessionContext","description":"Elevate sessions from unmanaged or external endpoints."}],"live":true,"detection_strategies":["DET0386"],"techniques":["T1087.004"]},{"id":"AN1090","stix_id":"x-mitre-analytic--089d588f-a6aa-4083-a900-ebcae97b5bfa","name":"Analytic 1090","description":"Access to organizational directories via Google Workspace Directory API, Slack SCIM, or Okta SCIM by apps or identities outside normal roles.","url":"https://attack.mitre.org/detectionstrategies/DET0386#AN1090","platforms":["SaaS"],"log_source_references":[{"name":"Google Admin Audit","channel":"users.list, groups.list","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"google-admin-audit"},{"name":"saas:okta","channel":"System API Call: user.read, group.read","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-okta"}],"mutable_elements":[{"field":"APIRequestRate","description":"Detect rapid enumeration attempts or recursive group expansion."},{"field":"AppIntegrationID","description":"Tag expected SCIM clients and suppress false positives from enterprise sync tools."},{"field":"GeoContext","description":"Trigger alerts if enumeration occurs from anomalous IPs or regions."}],"live":true,"detection_strategies":["DET0386"],"techniques":["T1087.004"]}],"live":true,"version":"1.0","techniques":["T1087.004"]}],"sigma_rules":[{"id":"35b781cc-1a08-4a5a-80af-42fd7c315c6b","title":"Discovery Using AzureHound","author":"Janantha Marasinghe","status":"test","level":"high","date":"2022-11-27","modified":null,"description":"Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.","references":["https://github.com/BloodHoundAD/AzureHound"],"logsource":{"product":"azure","service":"signinlogs"},"tags":["attack.discovery","attack.t1087.004","attack.t1526"],"path":"rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml","techniques":["T1087.004","T1526"],"cves":[]},{"id":"84b777bd-c946-4d17-aa2e-c39f5a454325","title":"RBAC Permission Enumeration Attempt","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":null,"description":"Detects identities attempting to enumerate their Kubernetes RBAC permissions.\nIn the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.\nIn a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a \"kubectl auth can-i --list\" command.\nThis will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.\n","references":["https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1069.003","attack.t1087.004","attack.discovery"],"path":"rules/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml","techniques":["T1069.003","T1087.004"],"cves":[]},{"id":"9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d","title":"AWS STS GetCallerIdentity Enumeration Via TruffleHog","author":"Adan Alvarez @adanalvarez","status":"experimental","level":"medium","date":"2025-10-12","modified":null,"description":"Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog.\nThreat actors leverage TruffleHog to enumerate and validate exposed AWS keys.\nSuccessful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.\n","references":["https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/","https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html","https://github.com/trufflesecurity/trufflehog"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.discovery","attack.t1087.004"],"path":"rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml","techniques":["T1087.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}