T1078.004: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Service or user accounts may be targeted by adversaries through Brute Force, Phishing, or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto Remote Services. High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based Software Deployment Tools to run commands on hybrid-joined devices.
An adversary may create long lasting Additional Cloud Credentials on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication.
Cloud accounts may also be able to assume Temporary Elevated Cloud Access or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through Cloud API or other methods.
Positive Technologies products that cover the technique
MaxPatrol SIEM knowledge base
yandex_cloud: PT-CR-1249: Yandex_Cloud_Admin_Role_Assign: A user assigned administrative access rights to a folder or cloud
yandex_cloud: PT-CR-1250: Yandex_Cloud_Cluster_Admin_Role_Assign: Rights are granted to a user
yandex_cloud: PT-CR-1251: Yandex_Cloud_Cluster_Potentially_Dangerous_Setting_Enable: Enabling of a potentially dangerous cluster setting is detected
yandex_cloud: PT-CR-1252: Yandex_Cloud_Cluster_User_Manage: A user account is created or changed
yandex_cloud: PT-CR-1256: Yandex_Cloud_Identity_Federation_Change: A user changed an identity federation
yandex_cloud: PT-CR-1257: Yandex_Cloud_Kubernetes_Cluster_Potentially_Dangerous_Setting_Enable: Enabling of a potentially dangerous cluster setting is detected
yandex_cloud: PT-CR-1259: Yandex_Cloud_Kubernetes_External_Address_Connection: A connection to a Kubernetes cluster from an external address is detected
yandex_cloud: PT-CR-1260: Yandex_Cloud_Kubernetes_Nodes_Potentially_Dangerous_Setting_Enable: Enabling of a potentially dangerous setting of a cluster node group is detected
yandex_cloud: PT-CR-1262: Yandex_Cloud_Membership_Manage_Role_Assign: A user assigned rights to manage membership in IAM groups
yandex_cloud: PT-CR-1265: Yandex_Cloud_Security_Group_Insecure_ACL_Assign: An insecure access control list is assigned to a security group
yandex_cloud: PT-CR-1266: Yandex_Cloud_Security_Group_Manipulation: A user performed actions on a security group
yandex_cloud: PT-CR-1267: Yandex_Cloud_Symmetric_Key_Access_Manage: Access rights to a symmetric key are changed
yandex_cloud: PT-CR-1268: Yandex_Cloud_Virtual_Machine_AWS_Token_Enable: Getting access keys to IAM credentials using AWS metadata is enabled on a virtual machine
mitre_attck_privilege_escalation: PT-CR-2434: Distribution_Group_Member_Added: Adding user to a distribution group
yandex_cloud: PT-CR-810: Yandex_Cloud_Access_Key_Manipulation: An access key is created or removed
yandex_cloud: PT-CR-811: Yandex_Cloud_API_Suspicious_Access: An API call is detected
yandex_cloud: PT-CR-815: Yandex_Cloud_Cluster_Creation_By_Not_Admin: A user who is not on the administrator list created a cluster
yandex_cloud: PT-CR-816: Yandex_Cloud_Privileged_Accounts_Activity: A privileged account activity is detected
yandex_cloud: PT-CR-817: Yandex_Cloud_Secret_Access_Manage: Access rights to a secret are changed
yandex_cloud: PT-CR-818: Yandex_Cloud_Service_Account_Suspicious_Activity: Activity of a service account from a range of IP-addresses outside the cloud is detected
yandex_cloud: PT-CR-825: Yandex_Cloud_Virtual_Machine_Suspicious_Service_Account_Assign: A service account with access to secrets is assigned to a virtual machine
vk_cloud: PT-CR-2102: VK_Cloud_Keypair_Operation: A user who is not on the allowed users list performed an operation with a key pair. This may indicate an attacker's attempt to create a rogue connection to a virtual machine via SSH or limit the ability to legitimately connect to a host.
vk_cloud: PT-CR-2105: VK_Cloud_VM_Security_Group_Operation: A user who is not on the allowed users list changed a security group list of a virtual machine, which may indicate an attacker's attempt to change the network configuration
Detection
ID | DS0028 | Data source and component | Logon Session: Logon Session Metadata | Description | Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). |
---|
ID | DS0002 | Data source and component | User Account: User Account Authentication | Description | Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account, account usage at atypical hours, or account authentication from unexpected locations or IP addresses. Service accounts should only be accessible from IP addresses from within the cloud environment. For example, in Azure AD environments, consider using Identity Protection to flag risky sign-ins based on location, device compliance, and other factors. In Okta environments, configure Suspicious Activity Reporting to allow users to report suspicious logins and other behavior they do not recognize. |
---|
ID | DS0028 | Data source and component | Logon Session: Logon Session Creation | Description | Monitor for suspicious account behavior across cloud services that share account. |
---|
Mitigation
ID | M1027 | Name | Password Policies | Description | Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge. Cloud service providers may track access key age to help audit and identify keys that may need to be rotated. |
---|
ID | M1015 | Name | Active Directory Configuration | Description | Disable legacy authentication, which does not support MFA, and require the use of modern authentication protocols instead. |
---|
ID | M1026 | Name | Privileged Account Management | Description | Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access, such as Global Administrator and Privileged Role Administrator in Azure AD. These reviews should also check if new privileged cloud accounts have been created that were not authorized. For example, in Azure AD environments configure alerts to notify when accounts have gone many days without using privileged roles, as these roles may be able to be removed. Consider using temporary, just-in-time (JIT) privileged access to Azure AD resources rather than permanently assigning privileged roles. |
---|
ID | M1032 | Name | Multi-factor Authentication | Description | Use multi-factor authentication for cloud accounts, especially privileged accounts. This can be implemented in a variety of forms (e.g. hardware, virtual, SMS), and can also be audited using administrative reporting features. |
---|
ID | M1036 | Name | Account Use Policies | Description | Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges. |
---|
ID | M1017 | Name | User Training | Description | Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications. |
---|
ID | M1018 | Name | User Account Management | Description | Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts. |
---|