{"id":"T1548.005","name":"Temporary Elevated Cloud Access","url":"https://attack.mitre.org/techniques/T1548/005","tactics":["privilege-escalation"],"platforms":["IaaS","Office Suite","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0393","stix_id":"x-mitre-detection-strategy--210a0dee-7c4b-4948-80ed-67c3e04886c2","name":"Detection Strategy for Temporary Elevated Cloud Access Abuse (T1548.005)","url":"https://attack.mitre.org/detectionstrategies/DET0393","analytics":[{"id":"AN1105","stix_id":"x-mitre-analytic--adfcc782-0285-43ef-af18-127dd60d1dff","name":"Analytic 1105","description":"Multiple AWS CloudTrail events indicating temporary privilege escalation via PassRole and AssumeRole targeting newly created services or non-interactive infrastructure.","url":"https://attack.mitre.org/detectionstrategies/DET0393#AN1105","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"PassRole","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"targetRoleName","description":"Define which roles are allowed to be assumed or passed; restrict highly privileged roles."},{"field":"TimeWindow","description":"Time range between PassRole and AssumeRole events to link the privilege chain."},{"field":"invokingService","description":"Restrict which services are authorized to invoke role passing (e.g., Lambda, EC2)."}],"live":true,"detection_strategies":["DET0393"],"techniques":["T1548.005"]},{"id":"AN1106","stix_id":"x-mitre-analytic--23b9a5cd-9c49-48d8-9d0d-71e35ad78337","name":"Analytic 1106","description":"Token creation or access delegation where a user impersonates a higher-privileged service account or performs domain-wide delegation actions, such as GCP's serviceAccountTokenCreator or Workspace impersonation.","url":"https://attack.mitre.org/detectionstrategies/DET0393#AN1106","platforms":["Identity Provider"],"log_source_references":[{"name":"gcp:iam","channel":"PrincipalEmail with serviceAccountTokenCreator impersonating new identity","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"gcp-iam"},{"name":"gcp:workspaceaudit","channel":"Token Generation via Domain Delegation","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"gcp-workspaceaudit"}],"mutable_elements":[{"field":"userEmailFilter","description":"Tune based on legitimate service accounts allowed to impersonate user accounts."},{"field":"delegatedScope","description":"Limit delegated access to specific scopes relevant to business functions."}],"live":true,"detection_strategies":["DET0393"],"techniques":["T1548.005"]},{"id":"AN1107","stix_id":"x-mitre-analytic--2ec84f0f-1148-4821-acf0-a5527381865f","name":"Analytic 1107","description":"Detection of ApplicationImpersonation role assignment or delegated mailbox access to service principals or rarely used users, especially outside of normal hours or geographic norms.","url":"https://attack.mitre.org/detectionstrategies/DET0393#AN1107","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"Add-MailboxPermission or Set-ManagementRoleAssignment","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"m365:signinlogs","channel":"Unusual sign-in from service principal to user mailbox","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"m365-signinlogs"}],"mutable_elements":[{"field":"TargetMailbox","description":"Mailbox of interest where impersonation or access delegation occurs."},{"field":"UserAgent","description":"Tune based on expected application or script-based mailbox access."},{"field":"GeoLocation","description":"Restrict based on corporate geography or travel expectations."}],"live":true,"detection_strategies":["DET0393"],"techniques":["T1548.005"]}],"live":true,"version":"1.0","techniques":["T1548.005"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}