1. Home
  2. ATT&CK Techniques
  3. T1538 Cloud Service Dashboard

T1538 Cloud Service Dashboard Mappings

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)

Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This allows the adversary to gain information without making any API requests.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-2 Account Management Protects T1538 Cloud Service Dashboard
AC-3 Access Enforcement Protects T1538 Cloud Service Dashboard
AC-5 Separation of Duties Protects T1538 Cloud Service Dashboard
AC-6 Least Privilege Protects T1538 Cloud Service Dashboard
IA-2 Identification and Authentication (organizational Users) Protects T1538 Cloud Service Dashboard
IA-8 Identification and Authentication (non-organizational Users) Protects T1538 Cloud Service Dashboard
azure_defender_for_resource_manager Azure Defender for Resource Manager technique_scores T1538 Cloud Service Dashboard
Comments
This control may alert on suspicious management activity based on IP, time, anomalous behaviour, or PowerShell usage. Machine learning algorithms are used to reduce false positives. The following alerts may be generated: "Activity from a risky IP address", "Activity from infrequent country", "Impossible travel activity", "Suspicious management session using PowerShell detected", "Suspicious management session using an inactive account detected", "Suspicious management session using Azure portal detected".
References
  1. https://docs.microsoft.com/en-us/azure/security-center/defender-for-resource-manager-introduction
  2. https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-resourcemanager
role_based_access_control Role Based Access Control technique_scores T1538 Cloud Service Dashboard
Comments
This control can be used to limit the number of users that have dashboard visibility thereby reducing the attack surface.
References
  1. https://docs.microsoft.com/en-us/azure/role-based-access-control/overview
azure_policy Azure Policy technique_scores T1538 Cloud Service Dashboard
Comments
This control may provide recommendations to enable Azure services that limit access to Azure Resource Manager and other Azure dashboards. Several Azure services and controls provide mitigations against this technique.
References
  1. https://docs.microsoft.com/en-us/azure/governance/policy/overview
  2. https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir