Scattered SpiderG1015 ↗
Abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.1
tfMITRE ATT&CK technique
Cloud Service Dashboard T1538
- Tactic
- Discovery
- Platforms
- IaaS, SaaS, Office Suite, Identity Provider
- Version
- 1.5
- Created
- 30 August 2019
- Last modified
- 24 October 2025
- Contributors
- Praetorian; Obsidian Security
An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Cloud Service Dashboard MITRE reference T1538
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
Offense vs defense T1538
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2023 Q2Cloud Service Dashboard detection strategy DET0291
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access
4 platforms
AN0808 · IaaS
Detects web console login events followed by read-only or metadata retrieval activity from GUI sources (e.g., browser session, mobile client) rather than API/CLI sources. Correlates across CloudTrail, IAM identity logs, and user-agent context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage MetadataDC0027 | AWS:CloudTrail | Post-authentication metadata enumeration from GUI session |
| Logon Session CreationDC0067 | AWS:CloudTrail | ConsoleLogin |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAgentFilter | Allowlist/denylist of user agents to distinguish browser-based vs. CLI/API sessions |
| TimeWindow | Maximum time delta between login and suspicious GUI activity |
| PrivilegedSessionThreshold | Login attempts to dashboard using elevated IAM roles |
AN0809 · Identity Provider
Detects successful login to cloud identity portals (e.g., Okta, Azure AD, Google Identity) from atypical geolocations, devices, or user agents immediately followed by dashboard/portal navigation to sensitive pages such as user or app configuration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | Sign-in with unfamiliar location/device + portal navigation |
| Application Log ContentDC0038 | saas:okta | WebUI access to administrator dashboard |
| Logon Session CreationDC0067 | saas:okta | user.session.start |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GeoIPAnomalyThreshold | Threshold for location anomalies per user profile |
| UserAgentReputation | Unknown browser/device fingerprint list |
| PrivilegedPageAccess | List of sensitive dashboard views for alerting |
AN0810 · Office Suite
Detects login to admin consoles (e.g., Microsoft 365 Admin Center) from unrecognized users, devices, or geolocations followed by non-API data review or configuration read actions that suggest GUI dashboard use.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | m365:signinlogs | UserLoginSuccess |
| Application Log ContentDC0038 | m365:unified | Read-only configuration review from GUI |
| Logon Session CreationDC0067 | m365:unified | ViewAdminReport |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AdminRoleList | Roles allowed to access dashboard views |
| DashboardNavigationSequence | Pageview paths or clickstreams indicating use of GUI admin console |
| GeoLocationRisk | List of high-risk regions or unexpected geos |
AN0811 · SaaS
Detects SaaS web login followed by dashboard or web GUI page views from unfamiliar locations, devices, or access patterns. Identifies use of sensitive reporting or configuration consoles accessed from high-risk accounts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | saas:salesforce | Login |
| Application Log ContentDC0038 | saas:box | User navigated to admin interface |
| Logon Session CreationDC0067 | saas:zoom | Zoom Admin Dashboard accessed from unfamiliar IP/device |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SaaSDashboardViewList | List of GUI pages or endpoints considered sensitive |
| IPReputationThreshold | Reputation score or allowlist of source IPs |
| LoginBehaviorBaseline | Typical user/device login pairings or login frequency |
Enforce the principle of least-privilege by limiting dashboard visibility to only the resources required. This may limit the discovery value of the dashboard in the event of a compromised account.