T1059.009sub-technique of T1059 Command and Scripting Interpreter
Cloud API
IaaS · Identity Provider · Office Suite · SaaSnothing on this site yetT1059.009 on attack.mitre.org
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Behavioral Detection of Malicious Cloud API Scripting
- Detects adversarial use of cloud APIs for command execution, resource control, or reconnaissance. Focuses on CLI/SDK/scripting language abuse via stolen credentials or in-browser Cloud Shells.
what reduces it
- M1038 Execution Prevention. Use application control where appropriate to block use of PowerShell CmdLets or other host based resources to access cloud API resources.
- M1026 Privileged Account Management. Use of proper Identity and Access Management (IAM) with Role Based Access Control (RBAC) policies to limit actions administrators can perform and provide a history of administrative actions to detect unauthorized use and abuse.