T1538 · Cloud Service Dashboard

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1538 · Cloud Service Dashboard · Sunturai

attack-patternenterprise-attackT1538

Cloud Service Dashboard

attack-pattern--e49920b0-6c54-40c1-9571-73723653205f

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard) Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.

Created: Aug 30, 2019, 6:11 PM UTC
Modified: Oct 24, 2025, 5:49 PM UTC

3 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
AWS SSM Inventory Reconnaissance by Rare User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Dataverse - Honeypot instance activity	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Okta Multiple Failed Requests to Access Applications	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 3 of 3

Filter in the catalogue

External references

mitre-attackT1538Open reference

AWS Console Sign-in EventsOpen reference

Google Command Center DashboardOpen reference

Platforms

IaaSIdentity ProviderOffice SuiteSaaS

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object