{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1538","id":"T1538","name":"Cloud Service Dashboard","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1538","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"486974aceb52101731b2945174f3993cab1e6828459127969a2d20af63a7a9ba","description":"An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)\n\nDepending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1538","external_id":"T1538"},{"source_name":"AWS Console Sign-in Events","description":"Amazon. (n.d.). AWS Console Sign-in Events. Retrieved October 23, 2019.","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html"},{"source_name":"Google Command Center Dashboard","description":"Google. (2019, October 3). Quickstart: Using the dashboard. Retrieved October 8, 2019.","url":"https://cloud.google.com/security-command-center/docs/quickstart-scc-dashboard"}],"platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0027","name":"Cloud Storage Metadata","page":"telemetry/DC0027/","kind":"attack_component","category":"Cloud storage","description":"Inventory attributes of cloud storage resources or objects.","collection_focus":"Take authorized metadata snapshots including resource ID, owner, region, encryption and policy summary; record observation time.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["bucket","region","encryption_enabled","public_access"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0027","collector":"illustrative-lab-collector","observation":{"bucket":"lab-bucket","region":"lab-region","encryption_enabled":true,"public_access":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1538","id":"T1538","name":"Cloud Service Dashboard","domain":"enterprise","platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1538","technique_page":"techniques/enterprise/T1538/","page":"detections/enterprise/T1538/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0291","name":"Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access","url":"https://attack.mitre.org/detectionstrategies/DET0291","stix_id":"x-mitre-detection-strategy--e2bf0a76-b5e4-4a23-adbb-024454f5dbdc","relationship_id":"relationship--3773ce57-ad3c-47ae-8484-6a42338dddf4","description":"","analytics":[{"id":"AN0808","name":"Analytic 0808","guidance":"Detects web console login events followed by read-only or metadata retrieval activity from GUI sources (e.g., browser session, mobile client) rather than API/CLI sources. Correlates across CloudTrail, IAM identity logs, and user-agent context.","url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0808","platforms":["IaaS"],"tuning":[{"field":"UserAgentFilter","description":"Allowlist/denylist of user agents to distinguish browser-based vs. CLI/API sessions"},{"field":"TimeWindow","description":"Maximum time delta between login and suspicious GUI activity"},{"field":"PrivilegedSessionThreshold","description":"Login attempts to dashboard using elevated IAM roles"}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"AWS:CloudTrail","channel":"ConsoleLogin","platforms":["IaaS"],"analytic_id":"AN0808","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0808","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0027","component":"Cloud Storage Metadata","name":"AWS:CloudTrail","channel":"Post-authentication metadata enumeration from GUI session","platforms":["IaaS"],"analytic_id":"AN0808","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0808","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0027/"}]},{"id":"AN0809","name":"Analytic 0809","guidance":"Detects successful login to cloud identity portals (e.g., Okta, Azure AD, Google Identity) from atypical geolocations, devices, or user agents immediately followed by dashboard/portal navigation to sensitive pages such as user or app configuration.","url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0809","platforms":["Identity Provider"],"tuning":[{"field":"GeoIPAnomalyThreshold","description":"Threshold for location anomalies per user profile"},{"field":"UserAgentReputation","description":"Unknown browser/device fingerprint list"},{"field":"PrivilegedPageAccess","description":"List of sensitive dashboard views for alerting"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"azure:signinlogs","channel":"Sign-in with unfamiliar location/device + portal navigation","platforms":["Identity Provider"],"analytic_id":"AN0809","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0809","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"saas:okta","channel":"user.session.start","platforms":["Identity Provider"],"analytic_id":"AN0809","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0809","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:okta","channel":"WebUI access to administrator dashboard","platforms":["Identity Provider"],"analytic_id":"AN0809","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0809","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0810","name":"Analytic 0810","guidance":"Detects login to admin consoles (e.g., Microsoft 365 Admin Center) from unrecognized users, devices, or geolocations followed by non-API data review or configuration read actions that suggest GUI dashboard use.","url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0810","platforms":["Office Suite"],"tuning":[{"field":"AdminRoleList","description":"Roles allowed to access dashboard views"},{"field":"DashboardNavigationSequence","description":"Pageview paths or clickstreams indicating use of GUI admin console"},{"field":"GeoLocationRisk","description":"List of high-risk regions or unexpected geos"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"m365:signinlogs","channel":"UserLoginSuccess","platforms":["Office Suite"],"analytic_id":"AN0810","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0810","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"m365:unified","channel":"ViewAdminReport","platforms":["Office Suite"],"analytic_id":"AN0810","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0810","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"Read-only configuration review from GUI","platforms":["Office Suite"],"analytic_id":"AN0810","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0810","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0811","name":"Analytic 0811","guidance":"Detects SaaS web login followed by dashboard or web GUI page views from unfamiliar locations, devices, or access patterns. Identifies use of sensitive reporting or configuration consoles accessed from high-risk accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0811","platforms":["SaaS"],"tuning":[{"field":"SaaSDashboardViewList","description":"List of GUI pages or endpoints considered sensitive"},{"field":"IPReputationThreshold","description":"Reputation score or allowlist of source IPs"},{"field":"LoginBehaviorBaseline","description":"Typical user/device login pairings or login frequency"}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"saas:zoom","channel":"Zoom Admin Dashboard accessed from unfamiliar IP/device","platforms":["SaaS"],"analytic_id":"AN0811","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0811","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0002","component":"User Account Authentication","name":"saas:salesforce","channel":"Login","platforms":["SaaS"],"analytic_id":"AN0811","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0811","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:box","channel":"User navigated to admin interface","platforms":["SaaS"],"analytic_id":"AN0811","source_url":"https://attack.mitre.org/detectionstrategies/DET0291#AN0811","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0027","name":"Cloud Storage Metadata","tag":"Cloud Storage Metadata","page":"telemetry/DC0027/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--450571d1-ce87-4017-bdc8-30fb2b6ae852","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce the principle of least-privilege by limiting dashboard visibility to only the resources required. This may limit the discovery value of the dashboard in the event of a compromised account.","relationship_id":"relationship--ba2b1689-b46c-4451-9618-1c1669a0da0c","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1538":"/ttp-simulation/techniques/enterprise/T1538/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1538","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0027","collector":"illustrative-lab-collector","observation":{"bucket":"lab-bucket","region":"lab-region","encryption_enabled":true,"public_access":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}