Which SIEM platforms have a T1069.003 detection rule?

df00tech provides T1069.003 (Cloud Groups) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Cloud Groups (T1069.003)?

Detecting Cloud Groups requires the following data sources: Cloud Service: Cloud Service Enumeration, Azure AD: Audit Logs, Process: Process Creation, Command: Command Execution.

What severity and confidence is the T1069.003 detection?

The T1069.003 detection is rated medium severity with medium confidence.

What are common false positives for T1069.003?

Common false positives for T1069.003 include: IT administrators performing routine group membership audits or access reviews using AzureAD PowerShell module; Microsoft Entra ID Governance access reviews that programmatically list group memberships; SIEM or CSPM tools (Defender for Cloud, Prisma Cloud) that periodically enumerate groups for compliance checks.

T1069.003 IBM QRadar · QRadar

Detect Cloud Groups in IBM QRadar

Adversaries may attempt to find cloud groups and permission settings to understand role assignments, privilege levels, and group memberships within a cloud environment. Tools such as Get-MsolRole (Office 365), az ad user get-member-groups (Azure CLI), ROADTools, AADInternals, and Pacu are used to enumerate cloud identity groups. In AWS, ListRolePolicies and ListAttachedRolePolicies enumerate role policies. Adversaries use this information to identify privileged accounts, determine lateral movement paths, and select targets for privilege escalation.

MITRE ATT&CK

Tactic: Discovery
Technique: T1069 Permission Groups Discovery
Sub-technique: T1069.003 Cloud Groups
Canonical reference: https://attack.mitre.org/techniques/T1069/003/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  QIDNAME(qid) AS EventName,
  CATEGORYNAME(category) AS Category,
  username,
  sourceip,
  LOGSOURCENAME(logsourceid) AS LogSource,
  LOGSOURCETYPENAME(devicetype) AS LogSourceType,
  devicecustomstring1 AS CommandLine,
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime
FROM events
WHERE
  starttime > (DATEADD('hour', -24, NOW()))
  AND
  (
    (
      LOGSOURCETYPEID IN (352, 397)
      AND QIDNAME(qid) IN (
        'List group members',
        'List groups',
        'Get group',
        'List directory roles',
        'List directory role members',
        'List role assignments',
        'Get role assignment',
        'Member.Read.All',
        'Group.Read.All'
      )
    )
    OR
    (
      LOGSOURCETYPEID IN (12, 13)
      AND eventid IN (1, 4688)
      AND (
        LOWER(devicecustomstring1) LIKE '%get-msolrole%'
        OR LOWER(devicecustomstring1) LIKE '%get-azureadgroup%'
        OR LOWER(devicecustomstring1) LIKE '%get-mggroup%'
        OR LOWER(devicecustomstring1) LIKE '%get-mgdirectoryrole%'
        OR LOWER(devicecustomstring1) LIKE '%az ad group%'
        OR LOWER(devicecustomstring1) LIKE '%az role assignment list%'
        OR LOWER(devicecustomstring1) LIKE '%az ad user get-member-groups%'
        OR LOWER(devicecustomstring1) LIKE '%listrolepolicies%'
        OR LOWER(devicecustomstring1) LIKE '%listattachedrolepolicies%'
        OR LOWER(devicecustomstring1) LIKE '%listgrouppolicies%'
        OR LOWER(devicecustomstring1) LIKE '%get-azroleassignment%'
        OR LOWER(devicecustomstring1) LIKE '%get-azadgroup%'
        OR LOWER(devicecustomstring1) LIKE '%roadrecon%'
        OR LOWER(devicecustomstring1) LIKE '%roadtools%'
        OR LOWER(devicecustomstring1) LIKE '%aadinternals%'
        OR LOWER(devicecustomstring1) LIKE '%invoke-aadintrecon%'
        OR LOWER(devicecustomstring1) LIKE '%azurehound%'
        OR LOWER(devicecustomstring1) LIKE '%stormspotter%'
        OR LOWER(devicecustomstring1) LIKE '%pacu%'
      )
    )
  )
ORDER BY starttime DESC

medium severity medium confidence

Detects cloud group enumeration (T1069.003) in IBM QRadar by matching two event streams: (1) Microsoft Office 365 and Azure AD DSM events (LOGSOURCETYPEID 352/397) containing group and role read operation names, and (2) Windows Security (Event 4688) and Sysmon (Event 1) process creation events (LOGSOURCETYPEID 12/13) where the command line contains known cloud group enumeration cmdlets or adversarial tools. The devicecustomstring1 field maps to the CommandLine/ProcessCommandLine property in both Windows Security and Sysmon log parsers.

Data Sources

IBM QRadar Microsoft Office 365 DSM (LOGSOURCETYPEID 352)IBM QRadar Microsoft Azure Active Directory DSM (LOGSOURCETYPEID 397)IBM QRadar Microsoft Windows Security Event Log DSM (LOGSOURCETYPEID 12, EventID 4688)IBM QRadar Microsoft Windows Sysmon DSM (LOGSOURCETYPEID 13, EventID 1)

Required Tables

events

False Positives & Tuning

Identity governance workflows that run bulk enumeration of Azure AD groups and role assignments using service principals for automated access certification campaigns
Azure AD Connect or cloud directory synchronization agents that read group membership data as part of scheduled synchronization cycles
Help desk automation or ITSM integrations using PowerShell runbooks to look up user group memberships during ticket resolution

Download portable Sigma rule (.yml)

Other platforms for T1069.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Enumerate Azure AD Groups via MSOnline PowerShell Module
Expected signal: Sysmon Event ID 1: PowerShell process creation with CommandLine containing 'Get-MsolRole' and 'Get-MsolRoleMember'. PowerShell ScriptBlock Log Event ID 4104 with full script content. Azure AD Audit Logs: 'List directory roles' and 'List directory role members' operations attributed to the authenticated user. Sysmon Event ID 3: Outbound network connections to login.microsoftonline.com and graph.windows.net.
Test 2Enumerate Azure AD Groups via Azure CLI
Expected signal: Sysmon Event ID 1: az.cmd process creation with CommandLine containing 'ad group list', 'ad user get-member-groups', 'role assignment list'. Sysmon Event ID 3: Network connections to management.azure.com and graph.microsoft.com. Azure AD Audit Logs: 'List groups', 'List role assignments' operations. File creation events (Sysmon ID 11) for output files in TEMP directory.
Test 3Enumerate AWS IAM Role Policies via AWS CLI
Expected signal: Sysmon Event ID 1: PowerShell and aws.exe process creation events with CommandLine containing 'list-roles', 'list-role-policies', 'list-attached-role-policies', 'list-groups'. Sysmon Event ID 3: Outbound connections to iam.amazonaws.com (port 443). File creation events for output files. AWS CloudTrail: ListRoles, ListRolePolicies, ListAttachedRolePolicies, ListGroups API calls attributed to the IAM principal.
Test 4Enumerate Azure AD Groups using Microsoft Graph PowerShell SDK
Expected signal: Sysmon Event ID 1: PowerShell process with CommandLine containing 'Get-MgGroup', 'Get-MgDirectoryRole', 'Get-MgDirectoryRoleMember'. Sysmon Event ID 3: Outbound connections to graph.microsoft.com (port 443). PowerShell ScriptBlock Log Event ID 4104. Azure AD Audit Logs: 'List groups', 'List directory roles', 'List directory role members' operations. Sysmon Event ID 11: CSV file creation in TEMP directory.

Last updated: 2026-04-17 Research depth: deep

References (13)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1069.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Cloud Groups in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1069.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1069.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox