Skip to content

T1078.004 Cloud Accounts

Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management systems, such as Windows Active Directory.123

Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a Trusted Relationship. Similar to Domain Accounts, compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.

Once a cloud account is compromised, an adversary may perform Account Manipulation - for example, by adding Additional Cloud Roles - to maintain persistence and potentially escalate their privileges.

Item Value
ID T1078.004
Sub-techniques T1078.001, T1078.002, T1078.003, T1078.004
Tactics TA0005, TA0003, TA0004, TA0001
Platforms Azure AD, Google Workspace, IaaS, Office 365, SaaS
Permissions required Administrator, User
Version 1.5
Created 13 March 2020
Last Modified 21 March 2023

Procedure Examples

ID Name Description
G0007 APT28 APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.13
G0016 APT29 APT29 has gained access to a global administrator account in Azure AD.16
G0064 APT33 APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.12
G0004 Ke3chang Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.14
G1004 LAPSUS$ LAPSUS$ has used compromised credentials to access cloud assets within a target organization.15
S0683 Peirates Peirates can use stolen service account tokens to perform its operations.11
S0684 ROADTools ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.10
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.17

Mitigations

ID Mitigation Description
M1036 Account Use Policies Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.4
M1015 Active Directory Configuration Disable legacy authentication, which does not support MFA, and require the use of modern authentication protocols instead.
M1032 Multi-factor Authentication Use multi-factor authentication for cloud accounts, especially privileged accounts. This can be implemented in a variety of forms (e.g. hardware, virtual, SMS), and can also be audited using administrative reporting features.5
M1027 Password Policies Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge. Cloud service providers may track access key age to help audit and identify keys that may need to be rotated.5
M1026 Privileged Account Management Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access, such as Global Administrator and Privileged Role Administrator in Azure AD.678 These reviews should also check if new privileged cloud accounts have been created that were not authorized. For example, in Azure AD environments configure alerts to notify when accounts have gone many days without using privileged roles, as these roles may be able to be removed.9 Consider using temporary, just-in-time (JIT) privileged access to Azure AD resources rather than permanently assigning privileged roles.8
M1018 User Account Management Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts.
M1017 User Training Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.

Detection

ID Data Source Data Component
DS0028 Logon Session Logon Session Creation
DS0002 User Account User Account Authentication

References

  1. Amazon. (n.d.). Identity Federation in AWS. Retrieved March 13, 2020. ↩

  2. Google. (n.d.). Federating Google Cloud with Active Directory. Retrieved March 13, 2020. ↩

  3. Microsoft. (n.d.). Deploying Active Directory Federation Services in Azure. Retrieved March 13, 2020. ↩

  4. Microsoft. (2022, December 14). Conditional Access templates. Retrieved February 21, 2023. ↩

  5. Moncur, Rob. (2020, July 5). New Information in the AWS IAM Console Helps You Follow IAM Best Practices. Retrieved August 4, 2020. ↩↩

  6. Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016. ↩

  7. Microsoft. (2016, April 16). Implementing Least-Privilege Administrative Models. Retrieved June 3, 2016. ↩

  8. Microsoft. (2022, November 14). Azure security baseline for Azure Active Directory. Retrieved February 21, 2023. ↩↩

  9. Microsoft. (2022, November 14). Configure security alerts for Azure AD roles in Privileged Identity Management. Retrieved February 21, 2023. ↩

  10. Dirk-jan Mollema. (2020, April 16). Introducing ROADtools - The Azure AD exploration framework. Retrieved January 31, 2022. ↩

  11. InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022. ↩

  12. Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020. ↩

  13. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  14. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩

  15. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  16. Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023. ↩

  17. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  18. Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023. ↩