T1098.001PersistencePrivilege Escalation
Additional Cloud Credentials
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID. These credentials include both x509 keys and passwords. With sufficient permissions…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
3 Sigma rules tagged T1098.001Additional Cloud CredentialsT1098.0013 general rules
- Added Credentials to Existing Applicationhightest
- Github Outside Collaborator Detectedmediumtest
- Okta Identity Provider Createdmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Additional Cloud Credentials
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.