MITRE ATT&CK T1538 Cloud Service Dashboard: Spotting Enumeration Early

An adversary who signs in to your cloud console with stolen credentials gets the same map of your estate that your administrators use, often without making a single API call you would alert on. MITRE ATT&CK T1538 Cloud Service Dashboard, in the Discovery tactic (TA0007), covers the use of a cloud service's graphical dashboard to learn about services, resources and features. ATT&CK v20 lists four platforms: IaaS, SaaS, Office Suite and Identity Provider, and notes that, depending on configuration, a dashboard may reveal more than the API would. This guide is for cloud security, identity and SOC teams. It covers who can reach which consoles, what the sign-in and portal logs show, how ATT&CK's detection strategy works in practice, and how to limit what a stolen console session can see. For SaaS-wide security programmes, see the Cybersecurity for SaaS Companies Guide.

Key takeaways

• The console is a discovery tool. ATT&CK's example is Google Cloud Security Command Center, where a user can view assets, review findings of security risks and run queries such as finding public IP addresses and open ports.
• Security dashboards are the richest target. A CSPM, CNAPP or security centre view lists every misconfiguration and exposed resource in one place, ranked for the reader.
• Sign-in is the best detection point. Many dashboard page views generate no audit record, so ATT&CK's detection strategy DET0291 correlates console sign-in context with what follows.
• Limit visibility, not just access. ATT&CK's only mapped mitigation, M1018 User Account Management, says to limit dashboard visibility to the resources each account needs.
• Treat admin portals as a separate resource. Conditional Access, device requirements and phishing-resistant MFA on admin consoles slow down an adversary even when a password is stolen.

What the technique covers

T1538 is about the interface, not the data: the same inventory an adversary could pull through T1526 Cloud Service Discovery or T1580 Cloud Infrastructure Discovery is gathered by browsing a web console. ATT&CK notes that this lets an adversary gather information without manually making API requests. Two consequences follow for defenders. First, many console page loads are read operations that some platforms do not log. Second, consoles aggregate: a single security overview page can show findings, exposure and asset counts that would take dozens of API calls to assemble. T1538 has no sub-techniques in v20.

Cases: dashboard use in real intrusions

• Scattered Spider (G1015): ATT&CK records that the group abused AWS Systems Manager Inventory to identify targets on the compromised network before lateral movement. The joint CISA and FBI advisory AA23-320A (November 2023, updated the same month) describes the actors enabling Systems Manager Inventory to find lateral movement targets and then moving to existing and actor-created EC2 instances. AWS documents that Inventory collects applications, network configuration, services, Windows updates and registry values from managed nodes, which is exactly the map an intruder wants. See the Scattered Spider Threat Actor Profile.
• Storm-0501 (G1053): Microsoft reported in August 2025 that Conditional Access required a hybrid-joined device for Azure portal access, so the actor moved laterally on premises until a sign-in from a hybrid-joined server succeeded, and only then operated in Azure. The device requirement on the portal did not stop the intrusion, but it forced extra steps that a monitored environment can catch.
• Help desk and SSPR abuse (Storm-2949, 2026): Microsoft described an actor taking Entra ID accounts by impersonating IT support and abusing self-service password reset, then using privileged custom Azure RBAC roles to reach Key Vault and storage. Any of those accounts would also have given console access. See the Storm-2949 Azure attack analysis.

What to detect: ATT&CK DET0291 in practice

DET0291 Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access has four analytics. Each starts at console sign-in and looks at what follows:

The tuning elements ATT&CK lists include a user agent allowlist to tell browsers from CLI sessions, a time window between login and activity, a list of sensitive dashboard pages, and per-user login baselines.

Log fields that matter

• AWS: CloudTrail records console sign-in as eventName ConsoleLogin from eventSource signin.amazonaws.com, with responseElements.ConsoleLogin set to Success or Failure, additionalEventData.MFAUsed set to Yes or No, and userIdentity.type of Root, IAMUser or AssumedRole for federated users. AWS notes that federated sign-ins show MFAUsed as No even when the identity provider enforced MFA, so judge federated MFA from the identity provider's logs. Root console sign-ins should be rare enough to alert on every one.
• Entra ID and Azure: sign-in logs show the resource accessed. The Azure portal's application ID is c44b4083-3bb0-49c1-b47d-974e53cbdf3c, and Microsoft groups it with the Exchange admin center, the Microsoft 365 portal and the Security and Compliance Center as "Microsoft Admin Portals".
• Microsoft 365 and SaaS: use the unified audit log and each SaaS platform's admin audit log for configuration and report views; check which views each product logs at your licence tier.

See the AWS CloudTrail Guide and the Entra ID Sign-In and Audit Log Detection Guide.

Detections NHI Mgmt Group recommends

1. Console sign-in by an identity that never uses the console: automation users, CI/CD roles and break-glass accounts. For non-human identities, a console sign-in is almost always wrong.
2. First-time console access to a security dashboard: a user opening Security Command Center, Defender for Cloud or Security Hub for the first time, especially soon after a password reset or MFA change.
3. Console sign-in without MFA: MFAUsed No on an IAM user, or a single-factor sign-in to Microsoft Admin Portals.
4. Enablement of inventory and collection features: new Systems Manager Inventory associations or similar collection settings created by an unusual principal, as in the Scattered Spider case.
5. Impossible or new context: console sign-in from a new country, hosting provider address or unmanaged device for an administrator.

Reducing what a stolen session can see

M1018 User Account Management is the only ATT&CK v20 mitigation mapped to T1538: enforce least privilege by limiting dashboard visibility to only the resources required, which limits the discovery value of the dashboard if an account is compromised. NHI Mgmt Group recommends these practical steps:

For small organisations, the first three rows give most of the benefit. Large estates with many tenants should add privileged access workstations and just-in-time elevation for anyone who can see security dashboards across the organisation. See the M1018 User Account Management page and the Cloud PAM and CIEM Guide.

Where identity fits

Dashboard discovery always starts with an authenticated session, so the controls live in identity. Two non-human identity points matter. First, machine identities should never hold console credentials: an IAM user with both an access key and a console password, or a service account allowed interactive sign-in, turns a leaked key into a full console session. Second, the security tools that read your estate (CSPM, CNAPP, inventory) are themselves dashboards: the identities and users who can sign in to them see every weakness at once. Review who has access to those consoles as carefully as cloud admin roles. See the If your CNAPP and CSPM platform is compromised playbook.

How to test your coverage

1. Sign-in visibility: sign in to each console with a test user and confirm the SIEM receives the event with user, source IP, user agent and MFA detail.
2. Page view visibility: open a security dashboard and an admin report, then check what was logged. Record gaps per platform; they decide whether you detect at sign-in only.
3. Policy checks: attempt admin console access from an unmanaged device and without phishing-resistant MFA; confirm the Conditional Access or equivalent policy blocks it.
4. Non-human identity check: list IAM users with console passwords and access keys, and service accounts with interactive sign-in; each should be zero or have a documented exception.
5. Roll back: remove test users and any temporary policy exclusions used for the test.

Metrics:

• Number of identities able to view security dashboards across the whole organisation.
• Percentage of admin console sign-ins using phishing-resistant MFA from managed devices.
• Number of non-human identities with console or interactive sign-in rights.
• Median time to alert on a console sign-in from a new country or hosting address in exercises.

Common failure patterns

• Organisation-wide viewer roles: Reader or ReadOnly at the top of the hierarchy is granted for convenience and turns any compromised account into a full map.
• Security dashboards open to many: CSPM findings visible to developers or contractors who do not need them.
• Federated MFA misread: treating MFAUsed No on federated AWS console sign-ins as a gap, or the reverse, ignoring identity provider evidence.
• Automation accounts with passwords: IAM users created for scripts that also have console access.
• Detection only on API calls: rules tuned to CLI user agents miss browser sessions entirely.

Framework mapping

See the ATT&CK Discovery Tactic (TA0007) Guide for how dashboard use fits the wider Discovery tactic.

Practitioner checklist

• Inventory every console that can show cloud, identity or security posture data, including security tools.
• Scope viewer roles to the smallest hierarchy level that does the job.
• Require phishing-resistant MFA and managed devices for admin portals.
• Remove console and interactive sign-in rights from every non-human identity.
• Alert on root and break-glass console sign-ins, and on console sign-ins without MFA.
• Alert on first-time security dashboard access and new inventory collection settings.
• Correlate password resets and MFA changes with console sign-ins that follow.
• Record which dashboard page views each platform logs, and close gaps where possible.

Standards and references

• MITRE ATT&CK: T1538 Cloud Service Dashboard
• MITRE ATT&CK: M1018 User Account Management
• CISA and FBI: AA23-320A Scattered Spider
• AWS: CloudTrail AWS Management Console sign-in events
• AWS: Systems Manager Inventory
• Microsoft Learn: Conditional Access target resources
• Microsoft Threat Intelligence: Storm-0501's evolving techniques lead to cloud-based ransomware
• Google Cloud: Security Command Center overview

Related NHI Mgmt Group resources: Cybersecurity for SaaS Companies Guide, T1580 and T1619 Cloud Infrastructure and Storage Discovery Guide, Cloud Security Posture Management (CSPM) Guide, MITRE ATT&CK T1078 Valid Accounts Guide.