Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1087.004_cloud-account
Adversaries may attempt to get a listing of cloud accounts.
Passed 22 of 25 test cases with the skill, and 16 of 25 without it.
and 5 more in the full report
6 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our threat intelligence team is mapping open-source cloud reconnaissance utilities referenced for Azure identity discovery. Which specific GitHub repository tool by True-Demon is cited for Azure active directory reconnaissance?
| Checked | Without skill | With skill |
|---|---|---|
| Cites the Raindance open-source tool. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1087
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
With authenticated access there are several tools that can be used to find accounts. The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365. The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command az ad user list will list all users within a domain.
The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix. In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.
Platforms: IaaS, Identity Provider, Office Suite, SaaS
Identify Attack Surface: Determine if the target environment is susceptible to Cloud Account by examining the target platforms (IaaS, Identity Provider, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1087.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.