Deactivation or stoppage of a cloud service (ex: AWS Cloudtrail StopLogging)
Deactivation or stoppage of a cloud service (ex: AWS Cloudtrail StopLogging)
| Domain | ID | Name | Detects | |
|---|---|---|---|---|
| Enterprise | T1562 | 妨碍防御 |
Monitor logs for API calls to disable logging. In AWS, monitor for: |
|
| .008 | Disable or Modify Cloud Logs |
Monitor logs for API calls to disable logging. In AWS, monitor for: |
||
An extracted list of cloud services (ex: AWS ECS ListServices)
An extracted list of cloud services (ex: AWS ECS ListServices)
| Domain | ID | Name | Detects | |
|---|---|---|---|---|
| Enterprise | T1526 | 云服务发现 |
Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.Normal, benign system and network events that look like cloud service discovery may be uncommon, depending on the environment and how they are used. Monitor cloud service usage for anomalous behavior that may indicate adversarial presence within the environment. |
|
| Enterprise | T1555 | 从密码存储中获取凭证 |
Monitor for API calls and CLI commands that attempt to enumerate and fetch credential material from cloud secrets managers, such as Analytic 1 - High volume of secret requests from unusual accounts or services.
|
|
| .006 | Cloud Secrets Management Stores |
Monitor for API calls and CLI commands that attempt to enumerate and fetch credential material from the secrets manager, such as Analytic 1 - High volume of secret requests from unusual accounts or services.
Analytic 2 - Cloud Service Enumeration
|
||
| Enterprise | T1046 | 网络服务发现 |
Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.Normal, benign system and network events that look like cloud service discovery may be uncommon, depending on the environment and how they are used. Monitor cloud service usage for anomalous behavior that may indicate adversarial presence within the environment. |
|
Contextual data about a cloud service and activity around it such as name, type, or purpose/function
Contextual data about a cloud service and activity around it such as name, type, or purpose/function
| Domain | ID | Name | Detects | |
|---|---|---|---|---|
| Enterprise | T1530 | 从云存储获取数据 |
Monitor M365 Audit logs for TeamsSessionStarted Operations against MicrosoftTeams workloads involving suspicious ClientIPs and suspect accounts (UserId). Analytic 1 - Sessions initiated from unusual IP addresses, high volume of sessions from a single account, sessions at unusual times
|
|
| Enterprise | T1213 | .002 | 从信息存储库获取数据: Sharepoint |
Monitor M365 Audit logs for FileAccessed operations against Sharepoint workloads. Scrutinize event metadata such as client IP address, ObjectId, UserId, User Agent, and Authentication type. Analytic 1 - Unusual file access patterns by users, anomalous IP addresses, or suspicious User Agents
|
| Enterprise | T1578 | 修改云计算基础设施 |
Monitor for quota increases across all regions, especially multiple quota increases in a short period of time or quota increases in unused regions. Monitor for changes to tenant-level settings such as subscriptions and enabled regions.[6] |
|
| Enterprise | T1114 | .003 | 电子邮件收集: Email Forwarding Rule |
Monitor M365 Audit logs for AlertTriggered operations with rule name "Creation of forwarding/redirect rule." or for New-InboxRule operations against Exchange Workloads. Look for anomalous modification properties such as actor user ID. An example event can show the creation of an email forwarding rule for a victim user Analytic 1 - Unauthorized email forwarding rule creation activities Note: To detect unauthorized email forwarding rule creation activities in M365 Audit logs.
Analytic 2 - Unauthorized email forwarding rule creation activities
|
Changes made to a cloud service, including its settings and/or data (ex: AWS CloudTrail DeleteTrail or DeleteConfigRule)
Changes made to a cloud service, including its settings and/or data (ex: AWS CloudTrail DeleteTrail or DeleteConfigRule)
| Domain | ID | Name | Detects | |
|---|---|---|---|---|
| Enterprise | T1546 | 事件触发执行 |
Monitor the creation and modification of cloud resources that may be abused for persistence, such as functions and workflows monitoring cloud events. |
|
| Enterprise | T1578 | .005 | 修改云计算基础设施: Modify Cloud Compute Configurations |
Monitor for quota increases across all regions, especially multiple quota increases in a short period of time or quota increases in unused regions. In Azure environments, monitor for changes to tenant-level settings such as enabled regions.[6] |
| Enterprise | T1666 | 修改云资源层次结构 |
Monitor for changes to resource groups, such as creating new resource groups or leaving top-level management groups. In Azure environments, monitor for changes to subscriptions.[6] In AWS environments, monitor for API calls such as |
|
| Enterprise | T1556 | 修改身份验证过程 |
Monitor for changes made to conditional access policies used by SaaS identity providers and internal IaaS identity and access management systems. Analytic 1 - Changes to access policies without corresponding change requests.
|
|
| .009 | Conditional Access Policies |
Monitor for changes made to conditional access policies used by SaaS identity providers and internal IaaS identity and access management systems. |
||
| Enterprise | T1562 | 妨碍防御 |
Monitor changes made to cloud services for unexpected modifications to settings and/or data. |
|
| .008 | Disable or Modify Cloud Logs |
Monitor changes made to cloud services for unexpected modifications to settings and/or data. Analytic 1 - Operations performed by unexpected initiators, frequent modifications, changes to critical resources
|
||
| Enterprise | T1648 | 无服务器执行 |
Monitor for unusual Serverless function modifications, such as adding roles to a function that allow unauthorized access or execution. Analytic 1 - Tracks actions related to creating or modifying serverless functions
|
|
| Enterprise | T1496 | 资源劫持 |
Monitor for changes to SaaS services, especially when quotas are raised or when new services are enabled. |
|
| .004 | Cloud Service Hijacking |
Monitor for changes to SaaS services, especially when quotas are raised or when new services are enabled. In AWS environments, watch for calls to Bedrock APIs like |
||