T1087.004
Cloud Account
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- AWS CloudTrail (the log as a whole)
- Azure Activity Log (control plane) (the log as a whole)
- Entra ID audit logs (the log as a whole)
- Other Azure sources (policy, VM guest, NSG flow) (the log as a whole)
- Entra ID sign-in logs (the log as a whole)
- Google Workspace audit logs
- Microsoft Defender XDR advanced hunting tables (the log as a whole)
- Okta System Log (the log as a whole)
- PowerShell logging (the log as a whole)