Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through Cloud Accounts, adversaries may generate or import their own SSH keys using either the <code>CreateKeyPair</code> or <code>ImportKeyPair</code> API in AWS or the <code>gcloud compute os-login ssh-keys add</code> command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_asset_inventory | Cloud Asset Inventory | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
This control may be able to detect when adversaries use cloud accounts to elevate privileges through manipulation of IAM or access policies for the creation of additional accounts. This monitoring can be fine tuned to specific assets, policies, and organizations.
References
|
| identity_aware_proxy | Identity Aware Proxy | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. IAP lets you enforce access control policies for applications and resources. This control may help mitigate against adversaries gaining access through cloud account by the configuration of access controls and firewalls, allowing limited access to systems.
References
|
| resourcemanager | ResourceManager | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
GCP offers Identity and Access Management (IAM), which lets admins give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This allows configuration of access controls and firewalls to limit access to critical systems and domain controllers.
References
|
| identityplatform | IdentityPlatform | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
Identity Platform can help protect your app's users and prevent account takeovers by offering multi-factor authentication (MFA) and integrating with Google's intelligence for account protection. This will help mitigate adversaries from gaining access to permission levels.
References
|
| chronicle | Chronicle | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
Chronicle is able to trigger an alert based on changes to Cloud Storage IAM permissions.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_gcs_iam_changes.yaral
References
|
| security_command_center | Security Command Center | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
SCC ingests Cloud Audit logs to detect when permissions are changed in a privileged group (i.e., modify group to public) with sensitive permissions or roles. This security solution protects against compromised cloud accounts used to maintain persistence. Because of the near-real time temporal factor to detect against this cyber-attack the control was graded as significant.
References
|
| virtual_private_cloud | Virtual Private Cloud | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
VPC further segments the environment by providing configurable granular access controls which help limit user permissions to communicate with critical systems.
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
Utilization and enforcement of MFA for user accounts to ensure that IAM policies are implemented properly shall mitigate adversaries so that they may not gain access to user accounts. Enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need.
References
|
| identity_and_access_management | Identity and Access Management | technique_scores | T1098.001 | Additional Cloud Credentials |
Comments
Privileged roles and permissions can be granted to entire groups of users by default, and admins can control unwanted access by utilizing machine learning to recommend smart access control permissions within an organization. This control can help mitigate adversaries from gaining access to unwanted account.
References
|