T1069.003 Cloud Groups Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let CloudGroupEnumCmdlets = dynamic([
  "Get-MsolRole", "Get-MsolRoleMember", "Get-AzureADGroup", "Get-AzureADGroupMember",
  "Get-AzureADDirectoryRole", "Get-AzureADDirectoryRoleMember",
  "Get-MgGroup", "Get-MgGroupMember", "Get-MgDirectoryRole", "Get-MgDirectoryRoleMember",
  "az ad group", "az ad user get-member-groups", "az role assignment list",
  "ListRolePolicies", "ListAttachedRolePolicies", "ListGroupPolicies",
  "Get-MsolGroupMember", "Get-AzRoleAssignment", "Get-AzADGroup"
]);
let SuspiciousTools = dynamic([
  "roadtools", "roadrecon", "aadinternals", "invoke-aadintrecon",
  "pacu", "stormspotter", "azurehound", "bloodhound"
]);
// Azure AD Audit Logs for group enumeration
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in~ (
    "List group members", "List groups", "Get group", "Get groups",
    "List directory roles", "List directory role members",
    "List role assignments", "Get role assignment"
  )
| where Result =~ "success"
| extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatedByApp = tostring(InitiatedBy.app.displayName)
| extend TargetResource = tostring(TargetResources[0].displayName)
| extend IPAddress = tostring(InitiatedBy.user.ipAddress)
| project TimeGenerated, OperationName, InitiatedByUser, InitiatedByApp,
          TargetResource, IPAddress, Result, CorrelationId
| union (
    // PowerShell-based enumeration via DeviceProcessEvents
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("powershell.exe", "pwsh.exe", "az.cmd", "az")
    | where ProcessCommandLine has_any (CloudGroupEnumCmdlets)
       or ProcessCommandLine has_any (SuspiciousTools)
    | extend InitiatedByUser = AccountName
    | extend InitiatedByApp = FileName
    | extend TargetResource = ProcessCommandLine
    | extend IPAddress = ""
    | extend CorrelationId = tostring(ProcessId)
    | project TimeGenerated = Timestamp, OperationName = ProcessCommandLine,
              InitiatedByUser, InitiatedByApp, TargetResource, IPAddress, Result = "process", CorrelationId
)
| sort by TimeGenerated desc

medium severity medium confidence

Data Sources

Cloud Service: Cloud Service Enumeration Azure AD: Audit Logs Process: Process Creation Command: Command Execution

Required Tables

AuditLogs DeviceProcessEvents

False Positives

IT administrators performing routine group membership audits or access reviews using AzureAD PowerShell module
Microsoft Entra ID Governance access reviews that programmatically list group memberships
SIEM or CSPM tools (Defender for Cloud, Prisma Cloud) that periodically enumerate groups for compliance checks
HR onboarding automation scripts that query group memberships to provision or deprovision user access
Azure DevOps pipelines with service principals that enumerate role assignments for deployment validation

Splunk

spl

index=o365 sourcetype="o365:management:activity"
  (Operation="List group members" OR Operation="List groups" OR Operation="Get group"
   OR Operation="List directory roles" OR Operation="List directory role members"
   OR Operation="List role assignments" OR Operation="Get role assignment"
   OR Operation="Member.Read.All" OR Operation="Group.Read.All")
| eval user=coalesce(UserId, Actor{}.ID)
| eval ip=coalesce(ClientIP, "unknown")
| eval app=coalesce(ApplicationId, Workload)
| stats count as TotalOps,
        dc(Operation) as UniqueOps,
        values(Operation) as Operations,
        earliest(_time) as FirstSeen,
        latest(_time) as LastSeen
        by user, ip, app
| eval TimeSpanMinutes=round((LastSeen - FirstSeen) / 60, 2)
| where TotalOps > 10 OR UniqueOps > 3
| eval SuspicionReason=case(
    TotalOps > 50, "High volume group enumeration",
    UniqueOps > 3 AND TimeSpanMinutes < 5, "Rapid multi-operation enumeration",
    TotalOps > 10, "Moderate volume group enumeration",
    true(), "Multiple group read operations"
  )
| table FirstSeen, LastSeen, user, ip, app, TotalOps, UniqueOps, TimeSpanMinutes, Operations, SuspicionReason
| sort - TotalOps
| union [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\az.cmd")
      (CommandLine="*Get-MsolRole*" OR CommandLine="*Get-AzureADGroup*" OR CommandLine="*Get-MgGroup*"
       OR CommandLine="*Get-AzureADDirectoryRole*" OR CommandLine="*az ad group*"
       OR CommandLine="*az ad user get-member-groups*" OR CommandLine="*az role assignment list*"
       OR CommandLine="*Get-AzRoleAssignment*" OR CommandLine="*Get-AzADGroup*"
       OR CommandLine="*roadrecon*" OR CommandLine="*aadinternals*" OR CommandLine="*azurehound*"
       OR CommandLine="*ListRolePolicies*" OR CommandLine="*ListAttachedRolePolicies*")
    | eval user=User, ip="endpoint", app=Image
    | eval TotalOps=1, UniqueOps=1, TimeSpanMinutes=0
    | eval SuspicionReason="Cloud group enumeration cmdlet detected on endpoint"
    | eval Operations=CommandLine
    | eval FirstSeen=_time, LastSeen=_time
    | table FirstSeen, LastSeen, user, ip, app, TotalOps, UniqueOps, TimeSpanMinutes, Operations, SuspicionReason
  ]

medium severity medium confidence

Data Sources

Cloud Service: Cloud Service Enumeration Office 365 Management Activity Process: Process Creation Sysmon Event ID 1

Required Sourcetypes

o365:management:activity XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

IT administrators performing routine group membership audits or access reviews using AzureAD PowerShell module
Microsoft Entra ID Governance automated access reviews that enumerate group memberships at scheduled intervals
SIEM or CSPM tools integrated with O365 that routinely query group membership for posture assessment
HR automation scripts querying group memberships for onboarding or offboarding workflows
Security operations tooling performing regular privileged account audits across Azure AD

Elastic Security (EQL)

eql

any where
(
  event.dataset == "azure.auditlogs" and
  event.outcome == "success" and
  event.action in~ (
    "List group members", "List groups", "Get group",
    "List directory roles", "List directory role members",
    "List role assignments", "Get role assignment"
  )
)
or
(
  event.category == "process" and
  event.type == "start" and
  process.name in~ ("powershell.exe", "pwsh.exe", "az.cmd", "az.exe") and
  process.command_line like~ (
    "*Get-MsolRole*", "*Get-MsolRoleMember*", "*Get-AzureADGroup*",
    "*Get-AzureADGroupMember*", "*Get-AzureADDirectoryRole*",
    "*Get-AzureADDirectoryRoleMember*", "*Get-MgGroup*", "*Get-MgGroupMember*",
    "*Get-MgDirectoryRole*", "*Get-MgDirectoryRoleMember*",
    "*az ad group*", "*az role assignment list*", "*az ad user get-member-groups*",
    "*ListRolePolicies*", "*ListAttachedRolePolicies*", "*ListGroupPolicies*",
    "*Get-AzRoleAssignment*", "*Get-AzADGroup*",
    "*roadrecon*", "*roadtools*", "*aadinternals*", "*invoke-aadintrecon*",
    "*azurehound*", "*stormspotter*", "*pacu*"
  )
)

medium severity medium confidence

Data Sources

Azure AD Audit Logs via Elastic Azure integration (logs-azure.auditlogs-*) Elastic Endpoint agent process events (logs-endpoint.events.process-*) Windows Sysmon via Elastic Agent (logs-system.security-* or winlog-*)

Required Tables

logs-azure.auditlogs-* logs-endpoint.events.process-* .ds-logs-endpoint.events.process-*

False Positives

IT administrators using Azure AD PowerShell (MSOnline, AzureAD, Microsoft.Graph modules) or az CLI for legitimate group management, access reviews, or identity reporting
Automated compliance or IAM governance scripts that enumerate group memberships on a scheduled basis using service account credentials
Azure AD Connect synchronization, CASB solutions, or cloud security posture management (CSPM) tools that continuously read group and role data for policy enforcement

IBM QRadar (AQL)

sql

SELECT
  QIDNAME(qid) AS EventName,
  CATEGORYNAME(category) AS Category,
  username,
  sourceip,
  LOGSOURCENAME(logsourceid) AS LogSource,
  LOGSOURCETYPENAME(devicetype) AS LogSourceType,
  devicecustomstring1 AS CommandLine,
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime
FROM events
WHERE
  starttime > (DATEADD('hour', -24, NOW()))
  AND
  (
    (
      LOGSOURCETYPEID IN (352, 397)
      AND QIDNAME(qid) IN (
        'List group members',
        'List groups',
        'Get group',
        'List directory roles',
        'List directory role members',
        'List role assignments',
        'Get role assignment',
        'Member.Read.All',
        'Group.Read.All'
      )
    )
    OR
    (
      LOGSOURCETYPEID IN (12, 13)
      AND eventid IN (1, 4688)
      AND (
        LOWER(devicecustomstring1) LIKE '%get-msolrole%'
        OR LOWER(devicecustomstring1) LIKE '%get-azureadgroup%'
        OR LOWER(devicecustomstring1) LIKE '%get-mggroup%'
        OR LOWER(devicecustomstring1) LIKE '%get-mgdirectoryrole%'
        OR LOWER(devicecustomstring1) LIKE '%az ad group%'
        OR LOWER(devicecustomstring1) LIKE '%az role assignment list%'
        OR LOWER(devicecustomstring1) LIKE '%az ad user get-member-groups%'
        OR LOWER(devicecustomstring1) LIKE '%listrolepolicies%'
        OR LOWER(devicecustomstring1) LIKE '%listattachedrolepolicies%'
        OR LOWER(devicecustomstring1) LIKE '%listgrouppolicies%'
        OR LOWER(devicecustomstring1) LIKE '%get-azroleassignment%'
        OR LOWER(devicecustomstring1) LIKE '%get-azadgroup%'
        OR LOWER(devicecustomstring1) LIKE '%roadrecon%'
        OR LOWER(devicecustomstring1) LIKE '%roadtools%'
        OR LOWER(devicecustomstring1) LIKE '%aadinternals%'
        OR LOWER(devicecustomstring1) LIKE '%invoke-aadintrecon%'
        OR LOWER(devicecustomstring1) LIKE '%azurehound%'
        OR LOWER(devicecustomstring1) LIKE '%stormspotter%'
        OR LOWER(devicecustomstring1) LIKE '%pacu%'
      )
    )
  )
ORDER BY starttime DESC

medium severity medium confidence

Data Sources

IBM QRadar Microsoft Office 365 DSM (LOGSOURCETYPEID 352) IBM QRadar Microsoft Azure Active Directory DSM (LOGSOURCETYPEID 397) IBM QRadar Microsoft Windows Security Event Log DSM (LOGSOURCETYPEID 12, EventID 4688) IBM QRadar Microsoft Windows Sysmon DSM (LOGSOURCETYPEID 13, EventID 1)

Required Tables

events

False Positives

Identity governance workflows that run bulk enumeration of Azure AD groups and role assignments using service principals for automated access certification campaigns
Azure AD Connect or cloud directory synchronization agents that read group membership data as part of scheduled synchronization cycles
Help desk automation or ITSM integrations using PowerShell runbooks to look up user group memberships during ticket resolution

Sumo Logic CSE

sql

(_sourceCategory=*o365* OR _sourceCategory=*azure/audit* OR _sourceCategory=*windows/sysmon* OR _sourceCategory=*windows/security*)
| where (Operation in ("List group members", "List groups", "Get group",
    "List directory roles", "List directory role members",
    "List role assignments", "Get role assignment",
    "Member.Read.All", "Group.Read.All"))
  OR (CommandLine matches "*Get-MsolRole*"
      OR CommandLine matches "*Get-MsolRoleMember*"
      OR CommandLine matches "*Get-AzureADGroup*"
      OR CommandLine matches "*Get-AzureADGroupMember*"
      OR CommandLine matches "*Get-AzureADDirectoryRole*"
      OR CommandLine matches "*Get-MgGroup*"
      OR CommandLine matches "*Get-MgDirectoryRole*"
      OR CommandLine matches "*az ad group*"
      OR CommandLine matches "*az role assignment list*"
      OR CommandLine matches "*az ad user get-member-groups*"
      OR CommandLine matches "*ListRolePolicies*"
      OR CommandLine matches "*ListAttachedRolePolicies*"
      OR CommandLine matches "*Get-AzRoleAssignment*"
      OR CommandLine matches "*Get-AzADGroup*"
      OR CommandLine matches "*roadrecon*"
      OR CommandLine matches "*aadinternals*"
      OR CommandLine matches "*invoke-aadintrecon*"
      OR CommandLine matches "*azurehound*"
      OR CommandLine matches "*stormspotter*"
      OR CommandLine matches "*pacu*")
| if (!isNull(UserId), UserId, if (!isNull(User), User, "unknown")) as actor
| if (!isNull(ClientIP), ClientIP, if (!isNull(src_ip), src_ip, "endpoint")) as source_ip
| if (!isNull(Operation), Operation, CommandLine) as action
| if (!isNull(ApplicationId), ApplicationId, if (!isNull(Image), Image, "unknown")) as app
| timeslice 5m
| count as ops by actor, source_ip, app, action, _timeslice
| sum(ops) as TotalOps, count_distinct(action) as UniqueOps by actor, source_ip, app, _timeslice
| where TotalOps > 10 OR UniqueOps > 3
| fields _timeslice, actor, source_ip, app, TotalOps, UniqueOps
| sort by TotalOps

medium severity medium confidence

Data Sources

Sumo Logic O365 Source (sourceCategory=*o365*) Sumo Logic Azure Audit Log Source (sourceCategory=*azure/audit*) Sumo Logic Windows Sysmon Source (sourceCategory=*windows/sysmon*, EventID 1) Sumo Logic Windows Security Source (sourceCategory=*windows/security*, EventID 4688)

Required Tables

_sourceCategory=*o365* _sourceCategory=*azure/audit* _sourceCategory=*windows/sysmon* _sourceCategory=*windows/security*

False Positives

Scheduled IAM governance or compliance reports that bulk-enumerate Azure AD group memberships and role assignments using dedicated service account credentials
Cloud security posture management (CSPM) or CIEM tools performing continuous assessment of role assignments, which may trigger volume thresholds
DevOps pipeline service principals using az CLI to validate role assignments before deploying infrastructure, generating multiple sequential read operations

Google Chronicle / SecOps

yaral

rule cloud_group_enumeration_t1069_003 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects cloud identity group and role enumeration (MITRE ATT&CK T1069.003) via Azure AD audit operations or endpoint-based PowerShell and CLI cmdlet execution"
    severity = "MEDIUM"
    priority = "MEDIUM"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1069.003"
    reference = "https://attack.mitre.org/techniques/T1069/003/"
    version = "1.0"
    created = "2026-04-17"

  events:
    (
      $e.metadata.event_type = "USER_RESOURCE_ACCESS" and
      re.regex($e.metadata.product_name, `(?i)Azure Active Directory|Microsoft 365|Office 365`) and
      re.regex($e.metadata.event_name,
        `(?i)(list group members|list groups|get group|list directory roles|list directory role members|list role assignments|get role assignment|Member\.Read\.All|Group\.Read\.All)`) and
      $e.security_result.action = "ALLOW"
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.file.full_path,
        `(?i)(powershell\.exe|pwsh\.exe|az\.cmd|az\.exe)$`) and
      re.regex($e.target.process.command_line,
        `(?i)(Get-MsolRole|Get-MsolRoleMember|Get-AzureADGroup|Get-AzureADGroupMember|Get-AzureADDirectoryRole|Get-AzureADDirectoryRoleMember|Get-MgGroup|Get-MgGroupMember|Get-MgDirectoryRole|Get-MgDirectoryRoleMember|Get-MsolGroupMember|Get-AzRoleAssignment|Get-AzADGroup|az\s+ad\s+group|az\s+ad\s+user\s+get-member-groups|az\s+role\s+assignment\s+list|ListRolePolicies|ListAttachedRolePolicies|ListGroupPolicies|roadrecon|roadtools|aadinternals|invoke-aadintrecon|azurehound|stormspotter|pacu)`)
    )

  condition:
    $e
}

medium severity medium confidence

Data Sources

Google Chronicle UDM - Azure Active Directory audit log feed (USER_RESOURCE_ACCESS events) Google Chronicle UDM - Microsoft 365 Management Activity feed Google Chronicle UDM - Endpoint EDR or Sysmon feed (PROCESS_LAUNCH events)

Required Tables

UDM events of type USER_RESOURCE_ACCESS UDM events of type PROCESS_LAUNCH

False Positives

Privileged Identity Management (PIM) access review workflows that enumerate group memberships and role assignments to generate review tasks for approvers
IT administrators running Get-AzureADGroup or Get-MgGroup cmdlets interactively in PowerShell sessions during routine group management operations
Azure AD monitoring or identity security tooling that reads group and directory role data continuously to detect shadow admins or excessive permissions

CrowdStrike LogScale (CQL)

cql

(#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2)
| ImageFileName = /(?i)(powershell\.exe|pwsh\.exe|az\.cmd|az\.exe)$/
| CommandLine = /(?i)(Get-MsolRole|Get-MsolRoleMember|Get-AzureADGroup|Get-AzureADGroupMember|Get-AzureADDirectoryRole|Get-AzureADDirectoryRoleMember|Get-MgGroup|Get-MgGroupMember|Get-MgDirectoryRole|Get-MgDirectoryRoleMember|Get-MsolGroupMember|Get-AzRoleAssignment|Get-AzADGroup|az\s+ad\s+group|az\s+ad\s+user\s+get-member-groups|az\s+role\s+assignment\s+list|ListRolePolicies|ListAttachedRolePolicies|ListGroupPolicies|roadrecon|roadtools|aadinternals|invoke-aadintrecon|azurehound|stormspotter|pacu)/
| groupBy(
    [ComputerName, UserName, UserSid, ImageFileName],
    function=[
      count(as=CmdletExecutions),
      min(timestamp, as=FirstSeen),
      max(timestamp, as=LastSeen),
      collect(CommandLine, limit=25, as=CommandLines)
    ]
  )
| sort(CmdletExecutions, order=desc)

medium severity high confidence

Data Sources

CrowdStrike Falcon EDR - ProcessRollup2 process execution events CrowdStrike Falcon EDR - SyntheticProcessRollup2 process execution events

Required Tables

ProcessRollup2 SyntheticProcessRollup2

False Positives

Authorized red team or penetration testing engagements using AzureHound, ROADrecon, or AADInternals within a documented scope — validate against engagement records before escalating
IT staff running Get-AzureADGroup, Get-MgGroup, or Get-AzRoleAssignment cmdlets interactively in PowerShell sessions for routine group or role management tasks
Automated provisioning or deprovisioning scripts that use Az CLI to enumerate and verify role assignments before modifying access, generating multiple sequential command executions

Cloud Groups

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Discovery

Popular Detections