T1087.004_cloud-account

T1087.004 Cloud Account

Sub-technique of: T1087

High-Level Description

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365. The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.

The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix. In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.

Kill Chain Phase

• Discovery (TA0007)

Platforms: IaaS, Identity Provider, Office Suite, SaaS

What to Check

• Identify if Cloud Account technique is applicable to target environment
• Check IaaS systems for indicators of Cloud Account
• Check Identity Provider systems for indicators of Cloud Account
• Check Office Suite systems for indicators of Cloud Account
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Cloud Account by examining the target platforms (IaaS, Identity Provider, Office Suite).

2. Assess Existing Defenses: Review whether mitigations for T1087.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1047 Audit

Routinely check user permissions to ensure only the expected users have the ability to list IAM identities or otherwise discover cloud accounts.

M1018 User Account Management

Limit permissions to discover cloud accounts in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.

Detection

Cloud Account Enumeration via API, CLI, and Scripting Interfaces

Risk Assessment

CWE Categories

References

• AWS List Roles
• AWS List Users
• Black Hills Red Teaming MS AD Azure, 2018
• Google Cloud - IAM Servie Accounts List API
• Microsoft AZ CLI
• Microsoft msolrolemember
• GitHub Raindance
• Atomic Red Team - T1087.004
• MITRE ATT&CK - T1087.004