tfMITRE ATT&CK sub-technique

Cloud Account T1087.004

sub-technique of T1087 Account Discovery

Tactic: Discovery
Platforms: IaaS, Identity Provider, Office Suite, SaaS
Version: 1.3
Created: 21 February 2020
Last modified: 24 October 2025
Contributor: Praetorian

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules69th pct

Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.

Cloud Account MITRE reference T1087.004

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-0501G1053 ↗

Has conducted enumeration of users, roles, and resources within victim Azure tenants using the tool Azurehound.1

created 2025-10-191 reference

APT29G0016 ↗

Has conducted enumeration of Azure AD accounts.1

created 2017-05-311 referenceaka IRON RITUAL

All 2 groups for this technique

Offense vs defense T1087.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 4

first rule: 2022 Q4 · 1 of 1 campaigns plotted

Cloud Account detection strategy DET0386

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Cloud Account Enumeration via API, CLI, and Scripting Interfaces

Enterprise

4 platforms

AN1087 · Identity Provider

Enumeration of identity roles and users via API calls such as Get-MsolRoleMember, az ad user list, or Graph API tokens from unauthorized users or automation accounts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	azure:signinlogs	Interactive/Non-Interactive Sign-In
User Account MetadataDC0013	Microsoft Entra ID Audit Logs	RoleManagement.Read.Directory or Directory.Read.All
Command ExecutionDC0064	m365:defender	Activity Log: Command Invocation

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TokenScope	Flags excessive or abnormal use of directory read scopes by unexpected principals.
AppContext	Differentiate authorized automation from rogue access tokens or external tools.
TimeWindow	Trigger correlation across short bursts of high-volume enumeration.

AN1088 · IaaS

Use of AWS CLI (aws iam list-users, list-roles), Azure CLI (az ad user list), or GCP CLI (gcloud iam service-accounts list) from endpoints or cloud shells where such activity is unexpected.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	AWS:CloudTrail	AWS IAM: ListUsers, ListRoles
User Account MetadataDC0013	azure:activity	Azure CLI Operation: Microsoft.Graph/users/read

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CallerType	Suppress known admin accounts and alert on developer/test/service identities.
CLIUserAgent	Correlate unexpected CLI user-agents and geolocation anomalies.
CloudRegion	Suppress noise from known IP ranges or whitelisted accounts per region.

AN1089 · Office Suite

Bulk enumeration of cloud user email identities through Get-Recipient, Get-Mailbox, Get-User, or Graph API directory listings by abnormal accounts or suspicious sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	Microsoft Graph API Logs	users.list, directoryObjects.getByIds
Command ExecutionDC0064	WinEventLog:PowerShell	CmdletName: Get-Recipient, Get-User

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CmdletVolume	Tune threshold for recipient/mailbox queries by volume per hour.
UserAgent	Match known admin consoles and exclude sanctioned tools like MSOL PowerShell.
SessionContext	Elevate sessions from unmanaged or external endpoints.

AN1090 · SaaS

Access to organizational directories via Google Workspace Directory API, Slack SCIM, or Okta SCIM by apps or identities outside normal roles.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	Google Admin Audit	users.list, groups.list
Application Log ContentDC0038	saas:okta	System API Call: user.read, group.read

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
APIRequestRate	Detect rapid enumeration attempts or recursive group expansion.
AppIntegrationID	Tag expected SCIM clients and suppress false positives from enterprise sync tools.
GeoContext	Trigger alerts if enumeration occurs from anomalous IPs or regions.

Cloud Account detections T1087.004

7 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

69th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs