AN0695
Analytic 0695
IaaS
Detects adversarial use of cloud-native APIs (e.g., AWS IAM, Azure RBAC, GCP Identity) to enumerate cloud group memberships or policy mappings via unauthorized sessions or scripts.
AWS:CloudTrail
ListGroups, ListAttachedRolePolicies
[UserContext]
Scope to anomalous IAM principals or assume-role usage.
[TimeWindow]
Correlate enumeration activity within lateral movement prep windows.
AN0696
Analytic 0696
Office Suite
Identifies unauthorized access or enumeration of administrative roles, security groups, or distribution groups via Exchange/SharePoint/Teams APIs or role discovery scripts.
m365:exchange
Get-RoleGroup, Get-DistributionGroup
m365:sharepoint
Enumerate ACLs/role bindings
[AccessScope]
Adjust based on tenant-level vs. site-level group visibility.
[ScriptExecutionContext]
Detect script-based role listing (e.g., Graph API call chains).
AN0697
Analytic 0697
SaaS
Monitors API calls and service-specific logs for enumeration of organizational roles, permissions, and group structure, particularly outside of normal admin behavior baselines.
saas:salesforce
GET /services/data/vXX.X/groups
[OrgScope]
Scope to cross-team access or unfamiliar org enumeration.
[RequestRate]
Tuning for excessive group-list API calls.