T1069.003 — Cloud Groups

Tactic: Discovery · Platforms: SaaS, IaaS, Office Suite, Identity Provider

Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access…

Sub-technique of Permission Groups Discovery (T1069).

Sigma detection rules (3)

T1069.003 Permission Groups Discovery: Cloud Groups

title: "T1069.003 Permission Groups Discovery: Cloud Groups"
id: b1006a18-58b5-4a15-9d63-b83f184be309
description: 'Behavioral Detection of Cloud Group Enumeration via API and CLI Access. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1069/003
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.discovery
  - attack.t1069.003

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
      - 'ListGroups'
      - 'GetGroup'
      - 'ListGroupsForUser'
      - 'ListAttachedGroupPolicies'
      - 'ListGroupPolicies'

  condition: selection

falsepositives:
  - IAM auditing tools, compliance scanners, and identity governance platforms routinely enumerate groups, so correlate with subsequent privilege escalation calls before escalating.

level: low

T1069.003 Permission Groups Discovery: Cloud Groups

title: "T1069.003 Permission Groups Discovery: Cloud Groups"
id: ba3cc227-659a-41ef-8ec2-565b59ca0feb
description: 'Behavioral Detection of Cloud Group Enumeration via API and CLI Access. (Data Component: Group Enumeration; baseline tier: fallback.) Tune using: OrgScope, RequestRate.'
references:
  - https://attack.mitre.org/techniques/T1069/003
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.discovery
  - attack.t1069.003

logsource:
  product: saas
  service: salesforce

detection:
  selection_setup_audit:
    Section: 'Manage Users'
    Action|contains:
      - 'permSetGroup'
      - 'roleViewed'
      - 'profileViewed'
  selection_api:
    EventType: 'ApiTotalUsage'

  condition: selection_setup_audit or selection_api

falsepositives:
  - Admins routinely reviewing permission sets, roles, and profiles as part of access administration; requires request-rate baselining to distinguish from bulk enumeration.

level: informational

T1069.003 Permission Groups Discovery: Cloud Groups

title: "T1069.003 Permission Groups Discovery: Cloud Groups"
id: dad30c4d-9fb4-4ac1-9b11-c4e8cc04a3b4
description: 'Behavioral Detection of Cloud Group Enumeration via API and CLI Access. Fixed the gcloud selector, which previously checked a1|contains: groups and would never match real invocations of gcloud identity groups list (a1 is identity, not groups); it now checks a1: identity and a2|contains: groups to align with the actual command shape. (Data Component: Command Execution; baseline tier: fallback.) Tune using: AccessScope, ScriptExecutionContext.'
references:
  - https://attack.mitre.org/techniques/T1069/003
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
  - attack.discovery
  - attack.t1069.003

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_aws:
    type: EXECVE
    a0|endswith: '/aws'
    a1: 'iam'
    a2|contains: 'group'
  selection_az:
    type: EXECVE
    a0|endswith: '/az'
    a1: 'ad'
    a2: 'group'
  selection_gcloud:
    type: EXECVE
    a0|endswith: '/gcloud'
    a1: 'identity'
    a2|contains: 'groups'

  condition: 1 of selection_*

falsepositives:
  - Cloud identity administrators and IAM auditing scripts legitimately enumerating groups as part of access reviews.

level: medium

Related sub-techniques

Explore