// MITRE ATT&CK

T1069.003 · Cloud Groups

🎯 Discovery SaaSIaaSOffice SuiteIdentity Provider Sub-technique

Sub-technique of T1069 · Permission Groups Discovery.

Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access ther...

How to detect & mitigate it

Detecting Cloud Groups starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.

Related techniques

Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.