Techniques › T1059.009 › AN0215
AN0215 Analytic 0215
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversarial use of cloud APIs for command execution, resource control, or reconnaissance. Focuses on CLI/SDK/scripting language abuse via stolen credentials or in-browser Cloud Shells. Monitors for anomalous API calls chained with authentication context shifts (e.g., stolen token -> privileged action) and cross-service impacts.</p>
- Detects
- T1059.009 Cloud API
- Part of
- DET0078 Behavioral Detection of Malicious Cloud API Scripting
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand | DC0064 Command Execution |
| azure:activity | operationName: Write, Access Review, RoleAssignment | DC0069 Cloud Service Modification |
| Okta:SystemLog | eventType: user.authentication.sso, app.oauth2.token.grant | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Off-hours API usage or configuration changes are more suspicious outside business context. |
UserAgent | Unexpected SDK usage (e.g., `boto3`, `azcopy`, unknown User-Agent strings). |
CredentialType | High-risk if access token or API key used outside expected geographic/IP behavior. |
APISequence | Unusual or rapid chaining of provisioning, IAM, and execution APIs. |
ConsoleContext | Browser-based Cloud Shell vs local CLI may indicate insider vs external use case. |