- Home
- Techniques
- Enterprise
- Valid Accounts
- Cloud Accounts
Valid Accounts: Cloud Accounts
Other sub-techniques of Valid Accounts (4)
| ID | Name |
|---|---|
| T1078.001 | Default Accounts |
| T1078.002 | Domain Accounts |
| T1078.003 | Local Accounts |
| T1078.004 | Cloud Accounts |
Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.[1][2][3]
Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a Trusted Relationship. Similar to Domain Accounts, compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
Procedure Examples
| Name | Description |
|---|---|
| APT33 |
APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.[6] |
Mitigations
| Mitigation | Description |
|---|---|
| Password Policies |
Ensure that privileged cloud accounts have complex, unique passwords across all systems on the network. |
| Privileged Account Management |
Audit cloud accounts permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. [4] [5] These audits should check if new cloud accounts are created that have not be authorized. |
Detection
Perform regular audits of cloud accounts to detect abnormal or malicious activity, such as accessing information outside of the normal function of the account or account usage at atypical hours.
References
- Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.
- Microsoft. (2016, April 16). Implementing Least-Privilege Administrative Models. Retrieved June 3, 2016.
- Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.