T1078.004 Cloud Accounts
Sub-technique of T1078 Valid Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- AWS IAM S3Browser LoginProfile Creationhightest · aws
- AWS IAM S3Browser Templated S3 Bucket Policy Creationhightest · aws
- AWS IAM S3Browser User or AccessKey Creationhightest · aws
- Application AppID Uri Configuration Changeshightest · azure
- Application URI Configuration Changeshightest · azure
- Azure Subscription Permission Elevation Via ActivityLogshightest · azure
- Changes To PIM Settingshightest · azure
- Okta New Admin Console Behaviourshightest · okta
- PIM Approvals And Deny Elevationhightest · azure
- Potential MFA Bypass Using Legacy Client Authenticationhightest · azure
- Sign-in Failure Due to Conditional Access Requirements Not Methightest · azure
- Sign-ins from Non-Compliant Deviceshightest · azure
- Temporary Access Pass Added To An Accounthightest · azure
- Use of Legacy Authentication Protocolshightest · azure
- User Added To Privilege Rolehightest · azure
- Users Added to Global or Device Admin Roleshightest · azure
- AWS Root Credentialsmediumtest · aws
- Account Disabled or Blocked for Sign in Attemptsmediumtest · azure
- Bitbucket User Login Failuremediumtest · bitbucket
- Bitlocker Key Retrievalmediumtest · azure
- Device Registration or Join Without MFAmediumtest · azure
- Github SSH Certificate Configuration Changedmediumtest · github
- Guest User Invited By Non Approved Invitersmediumtest · azure
- Login to Disabled Accountmediumtest · azure
- Multifactor Authentication Deniedmediumtest · azure
Showing 25 of 35.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.