T1069.003sub-technique of T1069 Permission Groups Discovery

Cloud Groups

SaaS · IaaS · Office Suite · Identity Providernothing on this site yetT1069.003 on attack.mitre.org

Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Cloud Group Enumeration via API and CLI Access

Detects adversarial use of cloud-native APIs (e.g., AWS IAM, Azure RBAC, GCP Identity) to enumerate cloud group memberships or policy mappings via unauthorized sessions or scripts.
Identifies unauthorized access or enumeration of administrative roles, security groups, or distribution groups via Exchange/SharePoint/Teams APIs or role discovery scripts.
Monitors API calls and service-specific logs for enumeration of organizational roles, permissions, and group structure, particularly outside of normal admin behavior baselines.

the rest of T1069

T1069.001 Local Groups · not covered yet
T1069.002 Domain Groups · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.