type: attack-pattern
spec_version: 2.1
id: attack-pattern--8f104855-e5b7-4077-b1f5-bc3103b41abe
created: 2020-02-21T21:08:36.570Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1087/004
external_id: T1087.004
source_name: AWS List Roles
description: Amazon. (n.d.). List Roles. Retrieved August 11, 2020.
url: https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html
source_name: AWS List Users
description: Amazon. (n.d.). List Users. Retrieved August 11, 2020.
url: https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html
source_name: Black Hills Red Teaming MS AD Azure, 2018
description: Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.
url: https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
source_name: Google Cloud - IAM Servie Accounts List API
description: Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.
url: https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list
source_name: Microsoft AZ CLI
description: Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
url: https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
source_name: Microsoft msolrolemember
description: Microsoft. (n.d.). Get-MsolRoleMember. Retrieved October 6, 2019.
url: https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrolemember?view=azureadps-1.0
source_name: GitHub Raindance
description: Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.
url: https://github.com/True-Demon/raindance
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:05.745Z
name: Cloud Account
description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) 

The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Praetorian
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Identity Provider
Office Suite
SaaS
x_mitre_version: 1.3