[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1078-004":3},{"item":4,"lessons":18,"controls":48,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1078-004","T1078.004","Cloud Accounts",7,"MITRE","**What attackers do.** Attackers use valid accounts in cloud environments, such as identity provider users, service accounts or cloud administrator accounts, to get in, stay in and raise their privileges. This serves Initial Access, Persistence, Privilege Escalation and Defence Evasion.\n\n**How to defend.** Enforce MFA for all cloud users, especially administrators, and use conditional access policies tied to device and location. Remove unused accounts and keys, rotate service credentials, and apply least privilege with just-in-time elevation. Collect cloud sign-in and audit logs centrally and keep them long enough to investigate.\n\n**Signs to look for.** Look for logins from unusual locations or anonymising networks, new access keys or credentials added to accounts, privilege changes and service accounts used interactively. A common gap is not monitoring non-interactive or workload identity sign-ins.","Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.\n\nService or user accounts may be targeted by adversaries through Brute Force, Phishing, or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto Remote Services. High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based Software Deployment Tools to run commands on hybrid-joined devices.\n\nAn adversary may create long lasting Additional Cloud Credentials on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1078\u002F004\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":25,"title":26,"published_at":27},"ai-orchestrated-cloud-attacks-exploit-compromised-service-principals","AI-Orchestrated Cloud Attacks Exploit Compromised Service Principals","2026-09-25T20:20:58.463+00:00",{"slug":29,"title":30,"published_at":31},"ghost-service-accounts-expose-m365-environments-to-data-theft","Ghost Service Accounts Expose M365 Environments to Data Theft","2026-09-24T19:20:31.202+00:00",{"slug":33,"title":34,"published_at":35},"default-passwords-on-service-accounts-fuel-microsoft-365-compromise","Default Passwords on Service Accounts Fuel Microsoft 365 Compromise","2026-09-24T10:21:44.924+00:00",{"slug":37,"title":38,"published_at":39},"exposed-iam-keys-enable-sub-10-minute-cloud-takeover-via-ai-accelerated-attacks","Exposed IAM Keys Enable Sub-10-Minute Cloud Takeover via AI-Accelerated Attacks","2026-07-27T16:21:14.843+00:00",{"slug":41,"title":42,"published_at":43},"oauth-client-id-spoofing-bypasses-entra-id-sign-in-detection-at-scale","OAuth Client ID Spoofing Bypasses Entra ID Sign-In Detection at Scale","2026-07-14T10:20:35.752+00:00",{"slug":45,"title":46,"published_at":47},"oauth-token-abuse-in-third-party-app-enables-salesforce-data-exfiltration","OAuth Token Abuse in Third-Party App Enables Salesforce Data Exfiltration","2026-06-23T22:21:03.358+00:00",[49,54,59,63,68,73],{"slug":50,"name":51,"problem":52,"stories":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",6,{"slug":55,"name":56,"problem":57,"stories":58},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",3,{"slug":60,"name":61,"problem":62,"stories":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":64,"name":65,"problem":66,"stories":67},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":69,"name":70,"problem":71,"stories":72},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",1,{"slug":74,"name":75,"problem":76,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[78,83,87,91,97,102,106,110],{"family":79,"item":80,"code":81,"title":82,"together":9},"cis","6","Control 6","Access Control Management",{"family":79,"item":84,"code":85,"title":86,"together":9},"5","Control 5","Account Management",{"family":88,"item":89,"code":90,"title":86,"together":9},"nist-800-53","ac-2","AC-2",{"family":92,"item":93,"code":94,"title":95,"together":96},"gdpr","32","Article 32","Security of processing",5,{"family":88,"item":98,"code":99,"title":100,"together":101},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",4,{"family":88,"item":103,"code":104,"title":105,"together":101},"ac-6","AC-6","Least Privilege",{"family":79,"item":107,"code":108,"title":109,"together":58},"8","Control 8","Audit Log Management",{"family":111,"item":112,"code":113,"title":114,"together":58},"nist-csf","pr-ac","PR.AC-1","Identity Management, Authentication and Access Control (CSF 1.1)"]