An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)
Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This allows the adversary to gain information without making any API requests.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| PR.AA-01.02 | Physical and logical access | Mitigates | T1538 | Cloud Service Dashboard |
Comments
This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts.
References
|
| PR.AA-01.01 | Identity and credential management | Mitigates | T1538 | Cloud Service Dashboard |
Comments
This diagnostic statement protects against Cloud Service Dashboard through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| IA-08 | Identification and Authentication (Non-Organizational Users) | mitigates | T1538 | Cloud Service Dashboard | |
| IA-02 | Identification and Authentication (Organizational Users) | mitigates | T1538 | Cloud Service Dashboard | |
| AC-02 | Account Management | mitigates | T1538 | Cloud Service Dashboard | |
| AC-03 | Access Enforcement | mitigates | T1538 | Cloud Service Dashboard | |
| AC-05 | Separation of Duties | mitigates | T1538 | Cloud Service Dashboard | |
| AC-06 | Least Privilege | mitigates | T1538 | Cloud Service Dashboard |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.In-memory | (malware never stored to persistent storage) | related-to | T1538 | Cloud Service Dashboard |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| azure_policy | Azure Policy | technique_scores | T1538 | Cloud Service Dashboard |
Comments
This control may provide recommendations to enable Azure services that limit access to Azure Resource Manager and other Azure dashboards. Several Azure services and controls provide mitigations against this technique.
References
|
| azure_role_based_access_control | Azure Role-Based Access Control | technique_scores | T1538 | Cloud Service Dashboard |
Comments
This control can be used to limit the number of users that have dashboard visibility thereby reducing the attack surface.
References
|
| defender_for_resource_manager | Microsoft Defender for Resource Manager | technique_scores | T1538 | Cloud Service Dashboard |
Comments
This control may alert on suspicious management activity based on IP, time, anomalous behaviour, or PowerShell usage. Machine learning algorithms are used to reduce false positives. The following alerts may be generated: "Activity from a risky IP address", "Activity from infrequent country", "Impossible travel activity", "Suspicious management session using PowerShell detected", "Suspicious management session using an inactive account detected", "Suspicious management session using Azure portal detected".
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| policy_intelligence | Policy Intelligence | technique_scores | T1538 | Cloud Service Dashboard |
Comments
This control may limit the number of users that have privileges to discover cloud infrastructure and may limit the discovery value of the dashboard in the event of a compromised account.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_config | AWS Config | technique_scores | T1538 | Cloud Service Dashboard |
Comments
The "mfa-enabled-for-iam-console-access" managed rule checks whether multi-factor authentication is enabled for all AWS IAM users that use a console password, protecting against misuse of those accounts' dashboard access. It is run periodically, and provides significant coverage, resulting in an overall score of Significant.
References
|
| aws_organizations | AWS Organizations | technique_scores | T1538 | Cloud Service Dashboard |
Comments
This control may protect against cloud service dashboard abuse by segmenting accounts into separate organizational units and restricting dashboard access by least privilege.
References
|