T1098.003PersistencePrivilege Escalation
Additional Cloud Roles
An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
7 Sigma rules tagged T1098.003Additional Cloud RolesT1098.0037 general rules
- App Granted Privileged Delegated Or App Permissionshightest
- App Assigned To Azure RBAC/Microsoft Entra Rolemediumtest
- Github Outside Collaborator Detectedmediumtest
- Google Workspace Application Access Level Modifiedmediumtest
- Granting Of Permissions To An Accountmediumtest
- Okta Admin Role Assigned to an User or Groupmediumtest
- User Added to an Administrator's Azure AD Rolemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Additional Cloud Roles
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.