Detect Cloud Account in Microsoft Sentinel
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access, tools such as Get-MsolRoleMember, az ad user list, aws iam list-users, aws iam list-roles, and gcloud iam service-accounts list can enumerate cloud accounts across Azure AD, AWS IAM, and GCP. Tools like ROADTools, AADInternals, AzureHound, and Pacu have been used by threat actors including APT29 and Storm-0501 to conduct this activity.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1087 Account Discovery
- Sub-technique
- T1087.004 Cloud Account
- Canonical reference
- https://attack.mitre.org/techniques/T1087/004/
KQL Detection Query
let CloudEnumPatterns = dynamic([
"Get-MsolRoleMember", "Get-MsolUser", "Get-AzureADUser", "Get-AzADUser",
"az ad user list", "az ad sp list", "az role assignment list", "az account list",
"aws iam list-users", "aws iam list-roles", "aws iam list-groups", "aws iam get-account-authorization-details",
"gcloud iam service-accounts list", "gcloud projects get-iam-policy", "gcloud organizations get-iam-policy",
"Get-MsolGroupMember", "Get-MsolServicePrincipal",
"Invoke-AzureHound", "roadrecon", "roadtools",
"AADInternals", "Get-AADIntUsers", "Get-AADIntTenantDetails",
"Invoke-Pacu", "pacu"
]);
let SuspiciousChildProcesses = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "python.exe", "python3"]);
// Detection 1: Process-based cloud enumeration commands
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (SuspiciousChildProcesses)
| where ProcessCommandLine has_any (CloudEnumPatterns)
| extend CloudPlatform = case(
ProcessCommandLine has_any ("Get-Msol", "Get-AzureAD", "Get-Az", "az ad", "az account", "AADInternals", "AzureHound", "roadrecon"), "Azure/M365",
ProcessCommandLine has_any ("aws iam"), "AWS",
ProcessCommandLine has_any ("gcloud iam", "gcloud projects", "gcloud organizations"), "GCP",
"Unknown"
)
| extend ToolCategory = case(
ProcessCommandLine has_any ("Invoke-AzureHound", "roadrecon", "roadtools", "AADInternals", "Get-AADInt", "Invoke-Pacu", "pacu"), "KnownOffensiveTool",
ProcessCommandLine has_any ("Get-MsolRoleMember", "Get-MsolUser", "az ad user list", "aws iam list-users", "gcloud iam service-accounts list"), "BuiltInEnumeration",
"Other"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
CloudPlatform, ToolCategory
| sort by Timestamp descDetects cloud account enumeration activity across Azure/M365, AWS, and GCP platforms by monitoring process command lines for known enumeration tools and commands. Covers built-in CLI tools (AZ CLI, AWS CLI, gcloud), PowerShell modules (MSOnline, AzureAD), and known offensive tools (AzureHound, ROADTools, AADInternals, Pacu). Classifies detections by cloud platform and tool category to aid triage.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators running legitimate user audits or access reviews using AZ CLI, AWS CLI, or PowerShell modules
- Security teams running authorized Identity Governance assessments or access certifications
- Automated scripts for user provisioning/deprovisioning that enumerate existing accounts before making changes
- Cloud cost optimization or compliance tooling that enumerates IAM resources for reporting
- DevOps pipeline scripts that validate service account existence before deployment
Other platforms for T1087.004
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Azure AD User Enumeration via AZ CLI
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe or powershell.exe, CommandLine containing 'az ad user list'. The Azure AD Audit Log will record 'List users' operations attributed to the authenticated service principal or user.
- Test 2AWS IAM User and Role Enumeration
Expected signal: Sysmon Event ID 1: Process Create for each aws CLI invocation with CommandLine containing 'aws iam list-users', 'aws iam list-roles', and 'aws iam get-account-authorization-details'. Sysmon Event ID 11: File Create for iam_dump.json in TEMP directory. AWS CloudTrail will record ListUsers, ListRoles, GetAccountAuthorizationDetails API calls.
- Test 3Azure AD Enumeration via PowerShell MSOnline Module
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-MsolUser', 'Get-MsolRoleMember'. PowerShell ScriptBlock Log Event ID 4104 with full module import and cmdlet invocation. Sysmon Event ID 11: File Create for msol_users.csv. Azure AD Audit Logs will record 'List users' and 'Get member' operations.
- Test 4GCP IAM Service Account Enumeration
Expected signal: Linux auditd or syslog: process execution of gcloud with arguments 'iam service-accounts list' and 'projects get-iam-policy'. GCP Cloud Audit Logs will record iam.serviceAccounts.list and cloudresourcemanager.projects.getIamPolicy Admin Activity operations attributed to the authenticated user or service account.
- Test 5Azure AD Enumeration via ROADTools (roadrecon)
Expected signal: Sysmon Event ID 1: Process Create for pip install (python.exe) and roadrecon.exe invocations with 'auth' and 'gather' subcommands. Sysmon Event ID 11: File Create for roadrecon_output.db in TEMP directory. Network connections from python.exe to login.microsoftonline.com and graph.microsoft.com. Azure AD Audit Logs will show bulk 'List users', 'List groups', 'List applications' operations.
References (14)
- https://attack.mitre.org/techniques/T1087/004/
- https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0
- https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
- https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html
- https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html
- https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list
- https://github.com/True-Demon/raindance
- https://dirkjanm.io/introducing-roadtools-framework/
- https://o365blog.com/aadinternals/
- https://github.com/BloodHoundAD/AzureHound
- https://github.com/RhinoSecurityLabs/pacu
- https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
- https://www.microsoft.com/en-us/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1087.004/T1087.004.md
Unlock Pro Content
Get the full detection package for T1087.004 including response playbook, investigation guide, and atomic red team tests.