Cloud account enumeration cmdlets in a PowerShell script block

1title: Cloud account enumeration cmdlets in a PowerShell script block2id: a09fd3e3-ae5a-4df7-96f1-1c0c8c9510173status: experimental4description: |5  Matches AN1089 on the only log source the brief gives it: a PowerShell6  script block that names a command which lists the accounts in a cloud tenant.7  Two groups are separated because they are not equally suspicious. The first8  holds the directory-wide calls — the MSOnline, AzureAD, Microsoft Graph,9  Microsoft Entra and Az identity cmdlets, and the `az`, `aws iam` and `gcloud`10  account-listing command lines, which appear in a script block when they are11  typed at or invoked from a PowerShell host — and it fires on its own. MSOnline12  and AzureAD are retired modules and are kept only because the technique text13  names `Get-MsolRoleMember`; the Graph SDK and Entra cmdlets beside them are14  added here, not taken from MITRE, and are what a current tenant would actually15  be enumerated with. The second holds16  `Get-Recipient`, `Get-Mailbox` and `Get-User`, which are the three most-used17  cmdlets in ordinary Exchange administration and are therefore gated behind a18  bulk marker (`-ResultSize Unlimited`) so that a single lookup of one mailbox19  does not match while a whole-tenant sweep does. That gate is also the rule's20  largest blind spot, and it is authored here rather than derived: those cmdlets21  return 1000 objects by default, so in any tenant smaller than that a bare22  `Get-Mailbox` enumerates every account and matches nothing below. The same23  three cmdlets are equally the observable for T1087.003 Email Account and this24  branch cannot separate the two; they are included because MITRE names them in25  AN1089 under this technique's strategy. Everything sits on26  `ScriptBlockText` under EventID 4104, the only field in this source carrying27  the script as the engine compiled it: an `-EncodedCommand` payload therefore28  arrives decoded, but decoded is not deobfuscated, and name splitting29  (`"Get-Msol"+"User"`), backtick insertion and wildcard command resolution30  (`&(gcm Get-Msol*)`) all survive compilation and defeat every literal term31  below. Three limits are structural. MITRE's `CmdletVolume` knob — the real32  discriminator here, since the abuse differs from administration mainly in how33  much is enumerated per hour — needs an aggregation lib/sigma does not model,34  so this rule sees single invocations and its level reflects that; the35  `UserAgent` and `SessionContext` knobs likewise have no field in this event.36  The rule can only see enumeration performed on a Windows host whose37  PowerShell is being logged, so an adversary calling Graph from their own38  machine, working in the Azure or Microsoft 365 admin portal, or running the39  same CLI commands from Linux or macOS writes nothing here at all — the tenant40  audit log is where that lives, and the brief supplies no log source for it.41  And the rule is written for 4104's `ScriptBlockText`; an estate collecting42  only 4103 module logging carries the invocation in `ContextInfo`/`Payload`43  instead and would need its own selection. Prerequisite: EventID 4104 requires44  *Script Block Logging* to be enabled by policy, which is off in a default45  install, and with it off this rule returns zero rows — which reads as quiet46  when it means blind.47  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0386, not hand-written and not tested by its author. Any lab result is on this rule's own page.48references:49  - https://attack.mitre.org/techniques/T1087/00450  - https://attack.mitre.org/detectionstrategies/DET038651author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)52date: 2026-08-1653tags:54  - attack.discovery55  - attack.t1087.00456logsource:57  product: windows58  service: powershell59detection:60  selection_directory:61    EventID: 410462    ScriptBlockText|contains:63      - 'Get-MsolUser'64      - 'Get-MsolRoleMember'65      - 'Get-AzureADUser'66      - 'Get-AzureADDirectoryRoleMember'67      - 'Get-MgUser'68      - 'Get-MgBetaUser'69      - 'Get-MgDirectoryRoleMember'70      - 'Get-EntraUser'71      - 'Get-EntraDirectoryRoleMember'72      - 'Get-AzADUser'73      - 'az ad user list'74      - 'aws iam list-users'75      - 'aws iam list-roles'76      - 'gcloud iam service-accounts list'77      - 'gcloud projects get-iam-policy'78  selection_recipient:79    EventID: 410480    ScriptBlockText|contains:81      - 'Get-Recipient'82      - 'Get-Mailbox'83      - 'Get-User'84  selection_bulk:85    EventID: 410486    ScriptBlockText|contains:87      - 'ResultSize Unlimited'88      - 'ResultSize:Unlimited'89  condition: selection_directory or (selection_recipient and selection_bulk)90falsepositives:91  - "Identity and licence reporting automation. Scheduled scripts that reconcile licences, feed a CMDB, build a joiner-mover-leaver report or export a tenant inventory call Get-MsolUser, Get-MgUser or Get-AzureADUser -All on a fixed interval from a management server, and enumerate far more accounts than an adversary would. On any tenant with such a job this is the highest-volume match by a wide margin and it is why this rule is low rather than medium — the volume threshold that would separate the two is MITRE's CmdletVolume knob, which cannot be expressed here."92  - "Everyday Exchange Online administration. Get-Mailbox -ResultSize Unlimited is the documented way to list every mailbox in a tenant and is the first line of most support, migration and reporting scripts, so the gated branch of this rule fires on ordinary service-desk and mail-team work."93  - "Backup, archiving and eDiscovery products, which page through Get-Recipient or Get-Mailbox across the whole tenant on every scheduled run, usually under a dedicated service account from a fixed host."94  - "Cloud infrastructure and CI automation running the AWS, Azure or Google CLIs from a PowerShell host — an `aws iam list-users` in a compliance check, a `gcloud projects get-iam-policy` in a Terraform wrapper or an access-review export — where enumerating principals is the point of the job."95  - "Authorised assessment work and tenant health checks, where a consultant's script enumerates users and directory role members as its first step and matches the entire first group in one run."96level: low