T1098.003sub-technique of T1098 Account Manipulation
Additional Cloud Roles
IaaS · Identity Provider · Office Suite · SaaS1 piece on this siteT1098.003 on attack.mitre.org
An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Business email compromise response plan: the money first, then the mailbox
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
how MITRE says to see it
Detection Strategy for Role Addition to Cloud Accounts
- Detection of new IAM roles or policies attached to a user/service in AWS/GCP/Azure outside normal patterns or hours, often following account compromise.
- Behavioral chain of a user being granted elevated privileges or roles in Entra ID or Okta following suspicious login or account creation activity.
- Detection of new admin or role assignment actions within Microsoft 365/O365 environments to elevate access for persistence or lateral movement.
what reduces it
- M1018 User Account Management. Ensure that low-privileged user accounts do not have permissions to add permissions to accounts or update IAM policies.
- M1026 Privileged Account Management. Ensure that all accounts use the least privileges they require. In Azure AD environments, consider using Privileged Identity Management (PIM) to define roles that require two or more approvals before assignment to users.
- M1032 Multi-factor Authentication. Use multi-factor authentication for user and privileged accounts.