Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through sync...
BY SOURCE
PROCEDURES (68)
Auto-extracted: 14 detections for general monitoring
Auto-extracted: 13 detections for authentication monitoring
Auto-extracted: 9 detections for bypass
Auto-extracted: 7 detections for api
Auto-extracted: 5 detections for persist
Auto-extracted: 4 detections for cloud monitoring
Auto-extracted: 4 detections for script execution monitoring
Auto-extracted: 4 detections for unusual
Auto-extracted: 4 detections for privilege
Auto-extracted: 4 detections for powershell
Auto-extracted: 3 detections for cloud
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for spray
Auto-extracted: 3 detections for lateral
Auto-extracted: 2 detections for azure
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for impersonat
Auto-extracted: 2 detections for email
Auto-extracted: 2 detections for spray
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for aws
Auto-extracted: 2 detections for cloud
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for brute force
Auto-extracted: 2 detections for token
Auto-extracted: 2 detections for saml
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for aws
Auto-extracted: 2 detections for unusual
Auto-extracted: 1 detections for oauth
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for email security
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for saml
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for kubernetes
Auto-extracted: 1 detections for kubernetes
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for impersonat
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for suspicious