T1087.004 Cloud Account

Technique

T1087.004

Tactics

Discovery

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

3

Elastic, Splunk

21

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1087/004

MITRE description

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-26 Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack
• 2026-10-21 Microsoft Threat Intelligence: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Detection coverage

SigmaHQ community rules

• RBAC Permission Enumeration Attempt (core)
• AWS STS GetCallerIdentity Enumeration Via TruffleHog (core)
• Discovery Using AzureHound (core)

Elastic and Splunk rules

• Anthropic Organization Member and Group Enumeration (elastic)
• AWS IAM Principal Enumeration via UpdateAssumeRolePolicy (elastic)
• AWS Discovery API Calls via CLI from a Single Resource (elastic)
• AWS STS GetCallerIdentity API Called for the First Time (elastic)
• AWS EC2 Role GetCallerIdentity from New Source AS Organization (elastic)
• AWS Account Discovery By Rare User (elastic)
• AWS STS GetCallerIdentity Bulk Account Enumeration (elastic)
• Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration (elastic)
• Entra ID ROPC Authentication with Unknown Client ID (elastic)
• Azure AD Graph High 4xx Error Ratio from User (elastic)
• Azure AD Graph Potential Enumeration (ROADrecon) (elastic)
• Azure AD Graph Access with Suspicious User-Agent (elastic)
• Azure AD Graph Access with Unusual Client and User (elastic)
• Entra ID Sign-in BloodHound Suite User-Agent Detected (elastic)
• Entra ID Sign-in TeamFiltration User-Agent Detected (elastic)
• Entra ID Managed Device Client Sign-In to Graph Enumeration (elastic)
• Microsoft Graph Application Directory Reconnaissance with Denied Requests (elastic)
• Okta IDP Lifecycle Modifications (splunk)
• Okta Unauthorized Access to Application (splunk)
• Azure AD AzureHound UserAgent Detected (splunk)
• Azure AD Service Principal Enumeration (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.