Detecting and Mitigating Cloud Account Discovery (T1087.004)

Cloud Account discovery (T1087.004) is the sub-technique of Account Discovery that lists identities in cloud and SaaS environments. It is a discovery technique for IaaS, Identity Provider, Office Suite and SaaS. The calls involved are ordinary, which is exactly why they are easy to miss.

How attackers use it

MITRE says adversaries may try to get a list of cloud accounts: the accounts organizations create for users, remote support, services or administration of resources in a cloud provider or SaaS application. With authenticated access, several tools can find accounts. The page names these:

• Office 365: the Get-MsolRoleMember PowerShell cmdlet returns account names for a role or permission group.
• Azure: the Azure CLI command az ad user list lists all users in a domain.
• AWS: aws iam list-users lists users in the current account, and aws iam list-roles lists roles with a specified path prefix.
• GCP: gcloud iam service-accounts list and gcloud projects get-iam-policy list service accounts and users in a project.

How to detect it

MITRE's strategy (DET0386) describes four analytics:

• Enumeration of roles and users through calls such as Get-MsolRoleMember or az ad user list, or Graph API tokens, by unauthorized users or automation accounts.
• Use of the AWS, Azure or GCP command line tools from endpoints or cloud shells where such activity is unexpected.
• Bulk enumeration of user email identities through Get-Recipient, Get-Mailbox, Get-User or Graph API directory listings by abnormal accounts or suspicious sessions.
• Access to organizational directories through the Google Workspace Directory API, Slack SCIM or Okta SCIM by apps or identities outside normal roles.

Control plane logs, such as the audit trail of each cloud provider, record these calls. The detection work is to decide which identities are expected to make them, and alert on the rest.

How to reduce the risk

MITRE lists two mitigations:

1. Audit. Routinely check user permissions so that only expected users can list IAM identities or discover cloud accounts.
2. User Account Management. Limit discovery permissions by least privilege. Reduce the number of users with administrative IAM roles, reduce permanent privileged role assignments, and review entitlements on IAM users, roles and policies periodically.

Check your own environment

• Which identities hold list permissions on IAM and your directory? Are any of them service accounts that never need it?
• Do your logs show who ran list calls over the last 30 days?
• Which SaaS apps have a directory or SCIM token, and who owns each?

If you use the AWS command line, this read-only call shows what an authenticated session sees. Run it with a low privilege identity and see whether it should succeed:

aws iam list-users --max-items 5

Try it yourself

You cannot protect accounts you cannot see. This demo shows asset discovery building one inventory across sources.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MITRE ATT&CK, T1087.004 Cloud Account: https://attack.mitre.org/techniques/T1087/004/