Account Discovery: Cloud Account `T1087.004`

Tactic: Discovery

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Authoring guide

These 32 rules share fields, values, and exclusions.

Fields filtered most (59 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	12	`eq` 11, `in` 1	`azure.aadgraphactivitylogs`, `aws.cloudtrail`, `azure.signinlogs`, `azure.activitylogs`, `azure.auditlogs`
`OperationName`	8	`contains` 6, `in` 2	`update a partner cross-tenant access setting`, `Add member to group`, `Add owner to group`, `Bulk invite users - started (bulk)`, `Invite external user`
`type`	8	`eq` 8	`policy`, `user`
`displayName`	7	`eq` 7	`tenantid`, `b2bcollaborationinbound`, `b2bcollaborationoutbound`, `b2bdirectconnectinbound`, `b2bdirectconnectoutbound`
`EventType`	5	`eq` 3, `in` 1, `ne` 1	`getcalleridentity`, `describecapacityreservations`, `describeorganization`, `describeorgnanizationalunit`, `describeresourcepolicy`
`Provider_Name`	5	`eq` 4, `in` 1	`iam.amazonaws.com`, `sts.amazonaws.com`, `cloudfront.amazonaws.com`, `cloudtrail.amazonaws.com`, `dynamodb.amazonaws.com`
`event.outcome`	5	`eq` 5	`success`, `failure`
`aws::eventName`	4	`eq` 4	`GetCallerIdentity`, `getcalleridentity`, `listroles`, `listusers`
`aws::eventSource`	4	`eq` 4	`iam.amazonaws.com`, `sts.amazonaws.com`
`aws::userAgent`	3	`eq` 1, `is_not_null` 1, `regex_match` 1	`(azure\|sharp\|blood)(hound)/.*`, `mozilla/5.0 (windows nt 10.0; win64; x64)...`
`sourcetype`	3	`eq` 3	`azure:monitor:aad`, `oktaim2:log`
`userAgent`	3	`contains` 3	`trufflehog`, `azurehound`
`PremodifiedInboundSettings`	2	`cross_field_compare` 2	`ModifiedInboundSettings`
`PremodifiedOutboundSettings`	2	`cross_field_compare` 2	`ModifiedOutboundSettings`
`aws::userIdentity.type`	2	`eq` 1, `ne` 1	`assumedrole`, `awsservice`

Top indicator values (166 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`type`	`eq`	`policy` kustoCross-tenant Access Settings Organization Added kustoCross-tenant Access Settings Organization Deleted kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	6	6
`type`	`eq`	`user` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin kustoGuest accounts added in Entra ID Groups other than the ones specified	2	16
`data_stream.dataset`	`eq`	`azure.aadgraphactivitylogs` elasticAzure AD Graph Access with Suspicious User-Agent elasticAzure AD Graph Access with Unusual Client and User elasticAzure AD Graph High 4xx Error Ratio from User elasticAzure AD Graph Potential Enumeration (ROADrecon) elasticEntra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration	5	6
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Account Discovery By Rare User elasticAWS Discovery API Calls via CLI from a Single Resource elasticAWS IAM Principal Enumeration via UpdateAssumeRolePolicy elasticAWS STS GetCallerIdentity API Called for the First Time	4	173
`data_stream.dataset`	`eq`	`azure.signinlogs` elasticEntra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration elasticEntra ID ROPC Authentication with Unknown Client ID elasticEntra ID Sign-in BloodHound Suite User-Agent Detected	3	36
`OperationName`	`contains`	`update a partner cross-tenant access setting` kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	4	4
`event.outcome`	`eq`	`success` elasticAWS Account Discovery By Rare User elasticAWS EC2 Role GetCallerIdentity from New Source AS Organization elasticAWS STS GetCallerIdentity API Called for the First Time elasticEntra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration	4	375
`EventType`	`eq`	`getcalleridentity` elasticAWS EC2 Role GetCallerIdentity from New Source AS Organization elasticAWS STS GetCallerIdentity API Called for the First Time	2	2
`PremodifiedInboundSettings`	`cross_field_compare`	`ModifiedInboundSettings` kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed	2	2
`PremodifiedOutboundSettings`	`cross_field_compare`	`ModifiedOutboundSettings` kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	2	2
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS Account Discovery By Rare User elasticAWS IAM Principal Enumeration via UpdateAssumeRolePolicy	2	32
`Provider_Name`	`eq`	`sts.amazonaws.com` elasticAWS EC2 Role GetCallerIdentity from New Source AS Organization elasticAWS STS GetCallerIdentity API Called for the First Time	2	12
`aws::eventSource`	`eq`	`iam.amazonaws.com` sigmaRole Enumeration sigmaUser Enumeration	2	28
`aws::eventSource`	`eq`	`sts.amazonaws.com` sigmaAWS STS GetCallerIdentity Enumeration Via TruffleHog pantherAWS STS GetCallerIdentity via TruffleHog	2	6
`azure.aadgraphactivitylogs.properties.actor_type`	`eq`	`user` elasticAzure AD Graph Access with Suspicious User-Agent elasticAzure AD Graph Access with Unusual Client and User	2	2
`displayName`	`eq`	`tenantid` kustoCross-tenant Access Settings Organization Added kustoCross-tenant Access Settings Organization Deleted	2	2
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD AzureHound UserAgent Detected splunkAzure AD Service Principal Enumeration	2	47
`userAgent`	`contains`	`trufflehog` sigmaAWS STS GetCallerIdentity Enumeration Via TruffleHog pantherAWS STS GetCallerIdentity via TruffleHog	2	3
`AppId`	`contains`	`04b07795-8ddb-461a-bbee-02f9e1bf7b46` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`12128f48-ec9e-42f0-b203-ea49fb6af367` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`14d82eec-204b-4c2f-b7e8-296a70dab67e` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`1950a258-227b-4e31-a9cf-717495945fc2` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`1b730954-1685-4b74-9bfd-dac224a7b894` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`23d8f6bd-1eb0-4cc2-a08c-7bf525c67bcd` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`31359c7f-bd7e-475c-86db-fdb8c937548e` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`90f610bf-206d-4950-b61d-37fa6fd1b224` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`9bc3ab49-b65d-410a-85ad-de819febfddc` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`9cee029c-6210-4654-90bb-17e6e9d36617` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`a0c73c16-a7e3-4564-9a95-2bdf47383716` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1
`AppId`	`contains`	`d1ddf0e4-d672-4dae-b554-9d5bdfd93547` kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin	1

Exclusions (18 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`terraform` elasticAWS Account Discovery By Rare User elasticAWS STS GetCallerIdentity API Called for the First Time	2
`aws::userAgent`	`contains`	`eksctl` elasticAWS STS GetCallerIdentity API Called for the First Time	1
`aws::userAgent`	`contains`	`pulumi` elasticAWS STS GetCallerIdentity API Called for the First Time	1
`AADGroupId`	`in`	`Custom AAD GROUP OBJECT ID 2` kustoGuest accounts added in Entra ID Groups other than the ones specified	1
`AADGroupId`	`in`	`List with Custom AAD GROUP OBJECT ID 1` kustoGuest accounts added in Entra ID Groups other than the ones specified	1
`ExtTenantIDAdded`	`in`	`List of expected tenant IDs` kustoCross-tenant Access Settings Organization Added	1
`ExtTenantIDAdded`	`in`	`Tenant ID 2` kustoCross-tenant Access Settings Organization Added	1
`aws::sessionCredentialFromConsole`	`eq`	`true` elasticAWS Account Discovery By Rare User	1
`aws::userIdentity.type`	`eq`	`assumedrole` elasticAWS STS GetCallerIdentity API Called for the First Time	1
`aws::userIdentity.type`	`eq`	`awsservice` elasticAWS Account Discovery By Rare User	1
`azure.aadgraphactivitylogs.properties.app_id`	`in`	`00000006-0000-0ff1-ce00-000000000000` elasticAzure AD Graph Access with Unusual Client and User	1
`azure.aadgraphactivitylogs.properties.app_id`	`in`	`18ed3507-a475-4ccb-b669-d66bc9f2a36e` elasticAzure AD Graph Access with Unusual Client and User	1
`azure.aadgraphactivitylogs.properties.app_id`	`in`	`74658136-14ec-4630-ad9b-26e160ff0fc6` elasticAzure AD Graph Access with Unusual Client and User	1
`azure.aadgraphactivitylogs.properties.app_id`	`in`	`bb8f18b0-9c38-48c9-a847-e1ef3af0602d` elasticAzure AD Graph Access with Unusual Client and User	1
`source.as.organization.name`	`eq`	`mongodb, inc.` elasticAWS EC2 Role GetCallerIdentity from New Source AS Organization	1

Account Discovery: Cloud Account `T1087.004`

Authoring guide

Fields filtered most (59 distinct)

Top indicator values (166 distinct)

Exclusions (18 distinct)

Rules under this technique

Sigma 5 rules

Elastic 13 rules

Splunk 4 rules

Kusto 8 rules

Panther 2 rules

Account Discovery: Cloud Account T1087.004

Authoring guide

Fields filtered most (59 distinct)

Top indicator values (166 distinct)

Exclusions (18 distinct)

Rules under this technique

Sigma 5 rules

Elastic 13 rules

Splunk 4 rules

Kusto 8 rules

Panther 2 rules

Account Discovery: Cloud Account `T1087.004`