kevmap

Techniques › T1021 › T1021.007

T1021.007 Cloud Services

lateral movement — IaaS, Identity Provider, Office Suite, SaaS · attack.mitre.org · JSON

1
MITRE detection strategy
4
analytics
1
Sigma rules tagged attack.t1021.007
0
KEV CVEs mapped here
<p>Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.</p><p>Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., Cloud API), using commands such as <code>Connect-AZAccount</code> for Azure PowerShell, <code>Connect-MgGraph</code> for Microsoft Graph PowerShell, and <code>gcloud auth login</code> for the Google Cloud CLI.</p><p>In some cases, adversaries may be able to authenticate to these services via Application Access Token instead of a username and password.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1021.007

AWS Console GetSigninToken Potential Abuse mediumtest
Author: Chester Le Bron (@123Le_Bron) · 2024-02-26 · logsource: product=aws service=cloudtrail · f8103686-e3e8-46f3-be72-65f7fcb4aa53
Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
Techniques: T1021.007T1550.001

Rules tagged at the parent level (attack.t1021) 11

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

OpenCanary - SMB File Open Request hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Techniques: T1021T1005
OpenCanary - FTP Login Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Techniques: T1190T1021
Psexec Execution mediumtest
Author: omkar72 · 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Techniques: T1569T1021
HackTool - NetExec Execution highexperimental
Author: Chirag Damani · 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d
Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Techniques: T1018T1021
Potential Remote Desktop Tunneling mediumtest
Author: Tim Rauch, Elastic (idea) · 2022-09-27 · logsource: product=windows category=process_creation · 8a3038e8-9c9d-46f8-b184-66234a160f6f
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Techniques: T1021
Privilege Escalation via Named Pipe Impersonation hightest
Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2022-12-30) · logsource: product=windows category=process_creation · 9bd04a79-dabe-4f1f-a5ff-92430265c96b
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Techniques: T1021
OpenCanary - VNC Connection Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 9db5446c-b44a-4291-8b89-fcab5609c3b3
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Techniques: T1021
OpenCanary - SSH New Connection Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Techniques: T1133T1021T1078
OpenCanary - SNMP OID Request hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Techniques: T1016T1021
New RDP Connection Initiated From Domain Controller hightest
Author: Josh Nickels · 2024-05-10 · logsource: product=windows category=network_connection · fda34293-718e-4b36-b018-38caab0d1209
Detects an RDP connection originating from a domain controller.
Techniques: T1021
OpenCanary - SSH Login Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
Techniques: T1133T1021T1078