T1078.004sub-technique of T1078 Valid Accounts
Cloud Accounts
IaaS · Identity Provider · Office Suite · SaaS18 pieces on this siteT1078.004 on attack.mitre.org
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Cloud account takeover response plan: sessions, methods, devices and grants, then what they read
A successful sign-in the user did not make, in Microsoft Entra ID and Microsoft 365. A password reset alone evicts almost nobody. The plan works through the order that does, how to tell a guessed password from a stolen session, and how to answer what they read.
Business email compromise response plan: the money first, then the mailbox
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
First 15 minutes: a successful sign-in from an IP address nobody recognises
A user's account signed in successfully from an address, country or device that does not fit. How to tell a traveller from a stolen session in five minutes, and what to cut off if it is the second.
First 15 minutes: a user is getting MFA prompts they did not start
Repeated MFA prompts mean somebody already has the password and is waiting for a tired tap. What to tell the user, what to check, and what to change so the next attempt fails.
First 15 minutes: a user typed their password into a phishing page
Assume the session was taken, not just the password. Revoke first, find everybody else the email reached, and check what the attacker did with the time they had.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
A credential is public
A secret scanner alert, a report from a researcher, or finding a key in a public repository.
Unexplained compute in a cloud account
A billing alert, instances nobody created, or a provider notification about mining.
Somebody talked the help desk into a reset
The service desk reset a password or an MFA method for a caller, and the real user says it was not them. Or a new MFA method appeared on an account straight after a help desk ticket.
A leaver's account is still being used
Sign-ins, mailbox activity or VPN sessions on the account of somebody who has left, or of a contractor whose engagement has ended.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Cloud identity and token theft detection pack for Entra ID and Okta
Four Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.
Hunt: successful sign-ins from an address the user has never used
For each account, the successful sign-ins from an IP address not seen for that account in the previous 30 days. The first question in any unfamiliar sign-in alert, asked across the whole tenant at once.
The evidence it leaves
Where the traces live, and what each source proves and does not.
AWS CloudTrail
Entra ID sign-in logs
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
Impossible travel, and then a mailbox rule
You have fifteen minutes. What are your first three queries, in order, and what single action do you take before any of them? Write down what you expect each query to return before you run it.
Read
Analyses, case studies, guides, references and interview questions.
Evidence Gap Challenge No. 1: the laptop was reimaged on Tuesday
A supplier is out €96,000 and the only endpoint that mattered was wiped on day one, by a helpdesk following the documented process correctly. Here is every artefact that still exists. Work out what you can prove, what you can only say is consistent, and the one collection change that would have moved the most from the second column to the first.
Entra ID sign-in logs: the fields and error codes that settle an account question
Which fields in a sign-in record separate a traveller from a stolen session, what the common error codes mean, where non-interactive sign-ins hide, and how long any of it is kept.
how MITRE says to see it
Detection of Abused or Compromised Cloud Accounts for Access and Persistence
- Detects anomalous authentication activity such as sign-ins from impossible geolocations or legacy protocols from high-privileged accounts.
- Detects cloud account use for API calls that exceed normal scope, such as IAM changes or access to services never used before.
- Detects unexpected access or usage of cloud productivity tools (e.g., downloading large numbers of files, creating external shares) by internal users.
- Detects login and usage patterns deviating from typical Microsoft 365 or Google Workspace user profiles.
what reduces it
- M1017 User Training. Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.
- M1027 Password Policies. Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge.
- M1018 User Account Management. Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts.
- M1026 Privileged Account Management. Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access, such as Global Administrator and Privileged Role Administrator in Azure AD. These reviews should also check if new privileged cloud accounts have been created that were not authorized.
- M1032 Multi-factor Authentication. Use multi-factor authentication for cloud accounts, especially privileged accounts. This can be implemented in a variety of forms (e.g. hardware, virtual, SMS), and can also be audited using administrative reporting features.
- M1015 Active Directory Configuration. Disable legacy authentication, which does not support MFA, and require the use of modern authentication protocols instead.