Techniques › T1538
T1538 Cloud Service Dashboard
discovery — IaaS, SaaS, Office Suite, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1538
0
KEV CVEs mapped here
<p>An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.</p><p>Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0291 Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access v1.0
AN0808 IaaSDetects web console login events followed by read-only or metadata retrieval activity from GUI sources (e.g., browser session, mobile client) rather than API/CLI sources. Correlates across CloudTrail, IAM identity logs, and user-agent context.AWS:CloudTrail
Post-authentication metadata enumeration from GUI session→ DC0027 Cloud Storage MetadataTunable:UserAgentFilterTimeWindowPrivilegedSessionThresholdAN0809 Identity ProviderDetects successful login to cloud identity portals (e.g., Okta, Azure AD, Google Identity) from atypical geolocations, devices, or user agents immediately followed by dashboard/portal navigation to sensitive pages such as user or app configuration.azure:signinlogsSign-in with unfamiliar location/device + portal navigation→ DC0002 User Account AuthenticationTunable:GeoIPAnomalyThresholdUserAgentReputationPrivilegedPageAccessAN0810 Office SuiteDetects login to admin consoles (e.g., Microsoft 365 Admin Center) from unrecognized users, devices, or geolocations followed by non-API data review or configuration read actions that suggest GUI dashboard use.Tunable:AdminRoleListDashboardNavigationSequenceGeoLocationRiskAN0811 SaaSDetects SaaS web login followed by dashboard or web GUI page views from unfamiliar locations, devices, or access patterns. Identifies use of sensitive reporting or configuration consoles accessed from high-risk accounts.Tunable:SaaSDashboardViewListIPReputationThresholdLoginBehaviorBaseline
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1538
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.