THREATNOIR
Subscribe
MITRE ATT&CK · T1078.004

Cloud Accounts

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers use valid accounts in cloud environments, such as identity provider users, service accounts or cloud administrator accounts, to get in, stay in and raise their privileges. This serves Initial Access, Persistence, Privilege Escalation and Defence Evasion.

How to defend. Enforce MFA for all cloud users, especially administrators, and use conditional access policies tied to device and location. Remove unused accounts and keys, rotate service credentials, and apply least privilege with just-in-time elevation. Collect cloud sign-in and audit logs centrally and keep them long enough to investigate.

Signs to look for. Look for logins from unusual locations or anonymising networks, new access keys or credentials added to accounts, privilege changes and service accounts used interactively. A common gap is not monitoring non-interactive or workload identity sign-ins.

Open the technique on MITRE ATT&CK
The official text
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory. Service or user accounts may be targeted by adversaries through Brute Force, Phishing, or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto Remote Services. High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based Software Deployment Tools to run commands on hybrid-joined devices. An adversary may create long lasting Additional Cloud Credentials on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.