Additional Cloud Credentials
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Mic...
BY SOURCE
PROCEDURES (21)
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for saml
Auto-extracted: 2 detections for token
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for api