{"id":"T1666","name":"Modify Cloud Resource Hierarchy","url":"https://attack.mitre.org/techniques/T1666","tactics":["defense-impairment"],"platforms":["IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0155","stix_id":"x-mitre-detection-strategy--fdcd77fc-d6da-4692-a978-461a7f7dba61","name":"Detection Strategy for Modify Cloud Resource Hierarchy","url":"https://attack.mitre.org/detectionstrategies/DET0155","analytics":[{"id":"AN0442","stix_id":"x-mitre-analytic--e246212e-aca3-489d-a2d9-7e24f7c3516c","name":"Analytic 0442","description":"Monitor for unauthorized or unusual modifications to cloud resource hierarchies such as AWS Organizations or Azure Management Groups. Defenders may observe anomalous calls to APIs like `LeaveOrganization`, `CreateAccount`, `MoveAccount`, or Azure subscription transfers. Correlate account activity with administrative role assignments, tenant transfers, or new subscription creation that deviates from organizational baselines. Multi-event correlation should track role elevation followed by hierarchy modifications within a short time window.","url":"https://attack.mitre.org/detectionstrategies/DET0155#AN0442","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"LeaveOrganization: API calls severing accounts from AWS Organizations","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"TimeWindow","description":"Threshold for correlating role elevation with hierarchy modification events."},{"field":"PrivilegedRoleList","description":"List of high-privilege roles (e.g., Global Administrator, OrganizationAccountAccessRole) used to monitor sensitive modifications."},{"field":"SubscriptionTransferPatterns","description":"Patterns of subscription changes that may indicate hijacking or unauthorized tenant transfers."}],"live":true,"detection_strategies":["DET0155"],"techniques":["T1666"]}],"live":true,"version":"1.0","techniques":["T1666"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}