T1078.004Initial AccessPersistencePrivilege EscalationStealth
Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
41 Sigma rules tagged T1078.004Cloud AccountsT1078.00441 general rules
- Application AppID Uri Configuration Changeshightest
- Application URI Configuration Changeshightest
- AWS IAM S3Browser LoginProfile Creationhightest
- AWS IAM S3Browser Templated S3 Bucket Policy Creationhightest
- AWS IAM S3Browser User or AccessKey Creationhightest
- Azure Subscription Permission Elevation Via ActivityLogshightest
- Changes To PIM Settingshightest
- Okta New Admin Console Behaviourshightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Cloud Accounts
1 CVE, by priority. Each link shows its badge.- CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication VulnerabilitySonicWall · SonicOSKEVRansomwarePublic exploitCritical · 9.8T1199Trusted RelationshipT1078.004Cloud Accounts+2 moreMITRE CTID mapping of the KEV entry · primary impact95.3%Top 0.13%79.8priority