Detecting Cloud Service Dashboard Use (T1538)

Cloud Service Dashboard (T1538) is a Discovery technique. An adversary signs in to a cloud service's graphical dashboard with stolen credentials to learn about an operational environment. MITRE lists IaaS, SaaS, Office Suite and Identity Provider.

How attackers use it

The dashboard gives a quick overview of services, resources and features. MITRE's example is the GCP Command Center, which shows all assets, lists findings about potential security risks and runs queries such as finding public IP addresses and open ports.

Depending on how the environment is set up, a dashboard can show more than an API would, and it saves the adversary from crafting API requests by hand. A console session can also look more like an ordinary user than scripted API traffic.

How to detect it

MITRE's analytics focus on the sign in and what follows:

• Web console login followed by read only or metadata activity from GUI sources such as a browser or mobile client, instead of API or CLI sources. Correlate across audit logs, identity logs and user agent context.
• Successful sign in to identity portals from atypical places, devices or user agents, followed by navigation to sensitive pages such as user or app configuration.
• Sign in to admin consoles from unrecognized users, devices or locations, followed by reading configuration.
• SaaS web login followed by page views of reporting or configuration consoles from unfamiliar locations or devices.

The essential question: does this identity normally use the console, from this place, on this kind of device?

How to reduce the risk

MITRE lists User Account Management: enforce least privilege by limiting dashboard visibility to the resources a user actually needs. That reduces what a stolen account can learn. Add phishing resistant multi-factor authentication and conditional access for console sign ins.

Quick check

Sources

• MITRE ATT&CK T1538, Cloud Service Dashboard