T1087.004 — Cloud Account

Tactic: Discovery · Platforms: IaaS, Identity Provider, Office Suite, SaaS

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are…

Sub-technique of Account Discovery (T1087).

Sigma detection rules (4)

T1087.004 Account Discovery: Cloud Account

title: "T1087.004 Account Discovery: Cloud Account"
id: fc0afc59-d43a-46b7-b441-9c53b87b3fdb
description: 'Cloud Account Enumeration via API, CLI, and Scripting Interfaces. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CallerType, CLIUserAgent, CloudRegion.'
references:
  - https://attack.mitre.org/techniques/T1087/004
author: Shahrukh Khan
date: 2026-02-16
license: MIT
tags:
  - attack.discovery
  - attack.t1087.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource:
      - 'iam.amazonaws.com'
      - 'sts.amazonaws.com'
    eventName:
      - 'ListUsers'
      - 'ListAccessKeys'
      - 'GetCallerIdentity'
      - 'ListMFADevices'
  selection_cli_agent:
    userAgent|contains: 'aws-cli'

  condition: selection and selection_cli_agent

falsepositives:
  - Legitimate operators using the AWS CLI for routine account audits will trigger this combination, so pair with unusual source IPs or a burst threshold for higher-fidelity alerting.

level: low

T1087.004 Account Discovery: Cloud Account

title: "T1087.004 Account Discovery: Cloud Account"
id: 4d013f80-6567-4fbb-86af-1732bf4eb7a2
description: 'Cloud Account Enumeration via API, CLI, and Scripting Interfaces. (Data Component: User Account Metadata; baseline tier: fallback.) Tune using: APIRequestRate, AppIntegrationID, GeoContext.'
references:
  - https://attack.mitre.org/techniques/T1087/004
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.discovery
  - attack.t1087.004

logsource:
  product: gcp
  service: workspaceaudit

detection:
  selection:
    events.name:
      - 'users.list'
      - 'groups.list'
      - 'USER_LIST_DOWNLOADED'

  condition: selection

falsepositives:
  - Administrators and provisioning tools that routinely enumerate users and groups through the Workspace Admin console or Directory API.

level: low

T1087.004 Account Discovery: Cloud Account

title: "T1087.004 Account Discovery: Cloud Account"
id: 41d3d09b-2335-4f08-8bda-fa696a2c0240
description: 'Cloud Account Enumeration via API, CLI, and Scripting Interfaces. (Data Component: User Account Metadata; baseline tier: fallback.) Broadened the az and gcloud selectors to also match "az ad user list" and "gcloud projects get-iam-policy", the exact enumeration commands cited in the technique, which the prior a1-only filters missed. Tune using: TokenScope, AppContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1087/004
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.discovery
  - attack.t1087.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_aws:
    type: EXECVE
    a0|endswith: '/aws'
    a1|contains:
      - 'iam'
      - 'sts'
  selection_az_account:
    type: EXECVE
    a0|endswith: '/az'
    a1|contains: 'account'
  selection_az_ad_user:
    type: EXECVE
    a0|endswith: '/az'
    a1: 'ad'
    a2|contains: 'user'
  selection_gcloud_auth_iam:
    type: EXECVE
    a0|endswith: '/gcloud'
    a1|contains:
      - 'auth'
      - 'iam'
  selection_gcloud_projects_policy:
    type: EXECVE
    a0|endswith: '/gcloud'
    a1: 'projects'
    a2|contains: 'get-iam-policy'

  condition: 1 of selection_*

falsepositives:
  - Cloud CLI account and identity queries are routine for engineers and automation scripts managing cloud resources from a Linux host.

level: low

T1087.004 Account Discovery: Cloud Account

title: "T1087.004 Account Discovery: Cloud Account"
id: d91fec85-f29b-46ec-a2d1-a3386fb61464
description: 'Cloud Account Enumeration via API, CLI, and Scripting Interfaces. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CmdletVolume, UserAgent, SessionContext.'
references:
  - https://attack.mitre.org/techniques/T1087/004
author: Shahrukh Khan
date: 2026-03-11
license: MIT
tags:
  - attack.discovery
  - attack.t1087.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1

  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'

  selection_cmdlets:
    CommandLine|contains:
      - 'Get-MsolUser'
      - 'Get-AzureADUser'
      - 'Get-MgUser'

  selection_generic_cmdlet:
    CommandLine|contains:
      - 'Get-Recipient'
      - 'Get-User'

  selection_bulk_flags:
    CommandLine|contains:
      - '-ResultSize Unlimited'
      - '-ResultSize unlimited'
      - '-Filter "*"'
      - "-Filter '*'"
      - '| Export-Csv'
      - '| ConvertTo-Csv'

  condition: selection and selection_img and (selection_cmdlets or (selection_generic_cmdlet and selection_bulk_flags))

falsepositives:
  - Routine administrative or reporting enumeration of cloud identities performed by IT staff and scheduled automation scripts using targeted (non-bulk) lookups.

level: low

Related sub-techniques

Explore