Detect Cloud API in IBM QRadar
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through CLIs (aws, az, gcloud), in-browser Cloud Shells, PowerShell modules, or SDKs. With proper permissions, adversaries may abuse cloud APIs to invoke functions across compute, storage, IAM, networking, and security services. APT29 has leveraged the Microsoft Graph API, TeamTNT has used AWS CLI with compromised credentials, and Storm-0501 has used cloud CLI for data exfiltration.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.009 Cloud API
- Canonical reference
- https://attack.mitre.org/techniques/T1059/009/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS "Event Time",
QIDNAME(qid) AS "Event Action",
username AS "Identity",
sourceip AS "Source IP",
CATEGORYNAME(category) AS "Category",
LOGSOURCENAME(logsourceid) AS "Log Source",
"deviceCustomString1" AS "Error Code",
"deviceCustomString2" AS "AWS Region",
UTF8(payload) AS "Raw Event"
FROM events
WHERE LAST 1 DAYS
AND (
LOGSOURCETYPENAME(logsourceid) ILIKE '%cloudtrail%'
OR LOGSOURCETYPENAME(logsourceid) ILIKE '%azure activity%'
OR LOGSOURCETYPENAME(logsourceid) ILIKE '%azure audit%'
)
AND (
QIDNAME(qid) IN (
'CreateUser', 'AttachUserPolicy', 'CreateAccessKey', 'CreateRole',
'AssumeRole', 'GetSessionToken', 'PutBucketPolicy', 'DeleteBucketPolicy',
'CreateFunction', 'UpdateFunctionCode', 'RunInstances', 'CreateKeyPair',
'StopLogging', 'DeleteTrail', 'PutEventSelectors',
'DisableGuardDuty', 'DeleteDetector', 'CreateGroup', 'AddMemberToGroup'
)
OR UTF8(payload) ILIKE '%roleDefinitions/write%'
OR UTF8(payload) ILIKE '%roleAssignments/write%'
OR UTF8(payload) ILIKE '%virtualMachines/write%'
)
ORDER BY starttime DESC
LIMIT 500Detects suspicious cloud API operations from AWS CloudTrail and Azure Activity log sources in IBM QRadar. Matches AWS-specific high-risk event names via QID resolution and Azure ARM operations via payload inspection. Covers IAM manipulation, security control disabling, and compute provisioning. The QIDNAME-based matching requires that cloud API events have been properly normalized in the QRadar DSM for the respective cloud log source type.
Data Sources
Required Tables
False Positives & Tuning
- CloudFormation, AWS CDK, or Terraform stack deployments create IAM roles, Lambda functions, and EC2 instances as planned changes — correlate against approved change tickets to exclude these
- Authorized cloud security assessments or penetration testing engagements using administrative API calls from known source IPs registered in the SOC allowlist
- Service accounts used by cloud inventory or billing tools (CloudHealth, Apptio Cloudability, AWS Cost Explorer automation) that regularly invoke cloud APIs for resource discovery and cost attribution
Other platforms for T1059.009
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS IAM User Enumeration via CLI
Expected signal: CloudTrail: ListUsers API call with source IP, user identity ARN, and user agent showing 'aws-cli'. The event will be logged regardless of success or failure.
- Test 2Azure Role Assignment Enumeration
Expected signal: Azure Activity Log: Microsoft.Authorization/roleAssignments/read operation. Sign-in log showing authentication event for the Azure CLI client.
- Test 3AWS CloudTrail Status Check
Expected signal: CloudTrail: GetTrailStatus API call. This read-only call is benign but its presence before StopLogging calls is a strong indicator pattern.
References (6)
- https://attack.mitre.org/techniques/T1059/009/
- https://github.com/Azure/azure-powershell
- https://docs.aws.amazon.com/cli/latest/reference/
- https://cloud.google.com/sdk/gcloud/reference
- https://github.com/RhinoSecurityLabs/pacu
- https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/
Unlock Pro Content
Get the full detection package for T1059.009 including response playbook, investigation guide, and atomic red team tests.