Techniques › T1136 › T1136.003
T1136.003 Cloud Account
persistence — IaaS, SaaS, Office Suite, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
3
Sigma rules tagged attack.t1136.003
0
KEV CVEs mapped here
<p>Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.</p><p>In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment. In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for Temporary Elevated Cloud Access. While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.</p><p>Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.</p><p>Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding Additional Cloud Credentials or assigning Additional Cloud Roles.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0319 Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office v1.0
AN0899 Identity ProviderAdversaries create user accounts via identity provider APIs or admin portals (e.g., Azure AD, Okta). These accounts may be assigned elevated privileges or used in chained authentication. Detection monitors Add User activity from suspicious IPs or automation sources, followed by role/permission escalation.Tunable:
IPAddressRoleThresholdServicePrincipalFlagAN0900 IaaSAdversaries use cloud API, CLI, or console to create IAM users or roles. Initial CreateUser is followed by policy/role attachment. Detection monitors temporal chains involving IAM:CreateUser, AttachUserPolicy, and credential generation, especially from automation or foreign IP ranges.Tunable:RegionTimeWindowUserAgentAN0901 SaaSAdversaries create SaaS accounts via admin dashboards or integrations (e.g., Zoom, Salesforce, Slack). Monitor lifecycle.create or account provisioning events from non-standard sources or times.Tunable:ApplicationScopeAdminUserListAN0902 Office SuiteAdversaries leverage M365 or Google Workspace APIs to create users, service accounts, or guest accounts. Follow-on behaviors include login activity, role escalation, or service principal token generation.Tunable:GroupSensitivityGuestFlag
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1136.003
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-29 · logsource: product=github service=audit · 3908d64a-3c06-4091-b503-b3a94424533b
Detects when a new member is added or invited to a github organization.
Author: Splunk Threat Research Team (original rule), '@ionsor (rule)'
· 2022-02-08 · logsource: product=m365 service=exchange · 42127bdd-9133-474f-a6f1-97b6c08a4339
Detects the addition of a new Federated Domain.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7
Detects when an ElastiCache security group has been created.
Rules tagged at the parent level (attack.t1136) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7
Detects when an ElastiCache security group has been created.
Author: Cedric Maurugeon
· 2023-08-22 · logsource: product=linux category=process_creation · b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
Detects user account creation on ESXi system via esxcli
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · e31bae15-83ed-473e-bf31-faf4f8a17d36
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.