Cloud Account
Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) In addition to user a...
BY SOURCE
PROCEDURES (18)
Auto-extracted: 3 detections for cloud
Auto-extracted: 3 detections for azure
Auto-extracted: 3 detections for oauth
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for api
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for azure