Detecting and Mitigating Cloud Groups Discovery (T1069.003)

Cloud Groups discovery (MITRE ATT&CK T1069.003) is a Discovery technique. MITRE lists SaaS, IaaS, Office Suite and Identity Provider as platforms.

Adversaries look for cloud groups and permission settings to learn the roles of users and groups, and which users are in which group.

How attackers use it

With authenticated access, several tools and APIs can list this information. MITRE gives these examples:

• The Get-MsolRole PowerShell cmdlet for roles and permission groups for Exchange and Office 365 accounts.
• az ad user get-member-groups in Azure CLI, which lists groups for an Azure user.
• The Google Cloud Identity API endpoint for listing group resources.
• In AWS, the calls ListRolePolicies and ListAttachedRolePolicies to see policies attached to a role.

Adversaries may also list ACLs for objects to learn the owner and other accounts with access, for example with the AWS GetBucketAcl API. That points them at accounts worth targeting, or at objects they can reach with accounts they already hold.

How to detect it

MITRE's detection strategy has three analytics: cloud-native API calls (AWS IAM, Azure RBAC, GCP Identity) that enumerate group memberships or policy mappings from unauthorized sessions or scripts; enumeration of administrative roles, security groups or distribution groups through Exchange, SharePoint or Teams APIs; and service logs that show enumeration of roles, permissions and group structure outside normal admin baselines.

So you need control plane audit logs from each provider, plus directory and Office audit logs. Baseline which identities normally list roles and groups, then flag the rest.

How to reduce the risk

MITRE lists no mitigations for this technique. Narrow, reviewed permissions and good audit logging are the practical response.

Quick check

Sources

• MITRE ATT&CK T1069.003: Cloud Groups