Cloud Service Dashboard `T1538`

Tactic: Discovery

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (17 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`ClientIp`	1	`is_not_null` 1
`EntityName`	1	`in` 1	`account`, `competitor`, `contact`
`EventType`	1	`eq` 1, `in` 1	`CreateAssociation`, `DescribeInstancePatches`, `GetInventory`
`InstanceUrl`	1	`eq` 1	`honeypot_dataverse_instances`
`Message`	1	`eq` 1	`UserSignIn`
`Provider_Name`	1	`eq` 1	`ssm.amazonaws.com`
`aws::eventName`	1	`in` 1	`CreateTrail`, `StartLogging`, `UpdateTrail`
`aws::requestParameters`	1	`contains` 1	`AWS-GatherSoftwareInventory`
`data_stream.dataset`	1	`eq` 1	`aws.cloudtrail`
`event.outcome`	1	`eq` 1	`success`
`eventType`	1	`eq` 1	`policy.evaluate_sign_on`, `user.authentication.sso`
`outcome.result`	1	`eq` 1	`CHALLENGE`, `SUCCESS`
`ratio`	1	`lt` 1	`0.5`
`sourcetype`	1	`eq` 1	`OktaIM2:log`
`target{}.type`	1	`eq` 1	`AppInstance`

Top indicator values (31 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`ClientIp`	`is_not_null`	kustoDataverse - Honeypot instance activity	1	2
`EntityName`	`in`	`account` kustoDataverse - Honeypot instance activity	1
`EntityName`	`in`	`competitor` kustoDataverse - Honeypot instance activity	1
`EntityName`	`in`	`contact` kustoDataverse - Honeypot instance activity	1
`EntityName`	`in`	`lead` kustoDataverse - Honeypot instance activity	1
`EntityName`	`in`	`opportunity` kustoDataverse - Honeypot instance activity	1
`EventType`	`eq`	`CreateAssociation` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`EventType`	`in`	`DescribeInstancePatches` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`EventType`	`in`	`GetInventory` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`EventType`	`in`	`GetInventorySchema` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`EventType`	`in`	`ListCommands` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`EventType`	`in`	`ListInventoryEntries` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`InstanceUrl`	`eq`	`honeypot_dataverse_instances` kustoDataverse - Honeypot instance activity	1
`Message`	`eq`	`UserSignIn` kustoDataverse - Honeypot instance activity	1	3
`Provider_Name`	`eq`	`ssm.amazonaws.com` elasticAWS SSM Inventory Reconnaissance by Rare User	1	5
`aws::eventName`	`in`	`CreateTrail` pantherA CloudTrail Was Created or Updated	1
`aws::eventName`	`in`	`StartLogging` pantherA CloudTrail Was Created or Updated	1
`aws::eventName`	`in`	`UpdateTrail` pantherA CloudTrail Was Created or Updated	1
`aws::requestParameters`	`contains`	`AWS-GatherSoftwareInventory` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS SSM Inventory Reconnaissance by Rare User	1	143
`event.outcome`	`eq`	`success` elasticAWS SSM Inventory Reconnaissance by Rare User	1	306
`eventType`	`eq`	`policy.evaluate_sign_on` splunkOkta Multiple Failed Requests to Access Applications	1	3
`eventType`	`eq`	`user.authentication.sso` splunkOkta Multiple Failed Requests to Access Applications	1
`outcome.result`	`eq`	`CHALLENGE` splunkOkta Multiple Failed Requests to Access Applications	1
`outcome.result`	`eq`	`SUCCESS` splunkOkta Multiple Failed Requests to Access Applications	1
`ratio`	`lt`	`0.5` splunkOkta Multiple Failed Requests to Access Applications	1	2
`sourcetype`	`eq`	`OktaIM2:log` splunkOkta Multiple Failed Requests to Access Applications	1	12
`target{}.type`	`eq`	`AppInstance` splunkOkta Multiple Failed Requests to Access Applications	1
`total_challenges`	`gt`	`0` splunkOkta Multiple Failed Requests to Access Applications	1
`total_challenges`	`gt`	`2` splunkOkta Multiple Failed Requests to Access Applications	1

Exclusions (5 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::errorCode`	`is_not_null`	pantherA CloudTrail Was Created or Updated	1
`aws::errorMessage`	`is_not_null`	pantherA CloudTrail Was Created or Updated	1
`aws::userIdentity.type`	`eq`	`AWSService` elasticAWS SSM Inventory Reconnaissance by Rare User	1
`user`	`ends_with`	`@onmicrosoft.com` kustoDataverse - Honeypot instance activity	1
`user`	`eq`	`honeypot_authorized_users` kustoDataverse - Honeypot instance activity	1

Rules under this technique

These vendors publish rules tagged with this technique.

Cloud Service Dashboard T1538

Authoring guide

Fields filtered most (17 distinct)

Top indicator values (31 distinct)

Exclusions (5 distinct)

Rules under this technique

Elastic 1 rule

Splunk 1 rule

Kusto 1 rule

Panther 1 rule

Cloud Service Dashboard `T1538`