ATT&CK technique
View on MITRE ATT&CK →
T1021.007
Cloud Services
Lateral Movement
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | AWS EC2 Instance Console Login via Assumed Role | production | 2026-10-06 |
| elastic | AWS SSM Session Started to EC2 Instance | production | 2026-09-18 |
| elastic | AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity | production | 2026-09-18 |
| elastic | Unusual AWS Command for a User | production | 2026-09-18 |
| elastic | Unusual Azure Activity Logs Event for a User | production | 2026-09-18 |
| elastic | Unusual GCP Event for a User | production | 2026-09-18 |
| splunk | Microsoft Intune Device Health Scripts | production | 2026-05-13 |
| splunk | Microsoft Intune DeviceManagementConfigurationPolicies | production | 2026-05-13 |
| splunk | Microsoft Intune Manual Device Management | production | 2026-05-13 |
| splunk | Microsoft Intune Mobile Apps | experimental | 2026-05-13 |
| splunk | Windows Azure PowerShell Module Installation Via PowerShell Script | production | 2026-05-13 |
| sigma | AWS Console GetSigninToken Potential Abuse | test | 2024-02-26 |