T1098.001 Additional Cloud Credentials

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)

In infrastructure-as-a-service (IaaS) environments, after gaining access through Cloud Accounts, adversaries may generate or import their own SSH keys using either the <code>CreateKeyPair</code> or <code>ImportKeyPair</code> API in AWS or the <code>gcloud compute os-login ssh-keys add</code> command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)

Adversaries may also use the <code>CreateAccessKey</code> API in AWS or the <code>gcloud iam service-accounts keys create</code> command in GCP to add access keys to an account. Alternatively, they may use the <code>CreateLoginProfile</code> API in AWS to add a password that can be used to log into the AWS Management Console for Cloud Service Dashboard.(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. Cloud Accounts).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)

In AWS environments, adversaries with the appropriate permissions may also use the sts:GetFederationToken API call to create a temporary set of credentials to Forge Web Credentials tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. (Citation: Crowdstrike AWS User Federation Persistence)

In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.IR-01.05 Remote access protection Mitigates T1098.001 Additional Cloud Credentials
Comments
This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
References
    PR.AA-05.02 Privileged system access Mitigates T1098.001 Additional Cloud Credentials
    Comments
    This diagnostic statement protects against Additional Cloud Credentials through the use of privileged account management and the use of multi-factor authentication.
    References
      DE.CM-06.02 Third-party access monitoring Mitigates T1098.001 Additional Cloud Credentials
      Comments
      This diagnostic statement protects against Additional Cloud Credentials through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
      References
        PR.AA-02.01 Authentication of identity Mitigates T1098.001 Additional Cloud Credentials
        Comments
        This diagnostic statement provides protection from Account Manipulation through the implementation of privileged account management controls to limit credential access. Employing limitations to specific accounts, access control mechanisms, and auditing the attribution logs provides protection against adversaries attempting to modify accounts.
        References
          PR.PS-01.07 Cryptographic keys and certificates Mitigates T1098.001 Additional Cloud Credentials
          Comments
          This diagnostic statement protects against Account Manipulation through the use of revocation of keys and key management. Employing limitations to specific accounts along with access control mechanisms provides protection against adversaries attempting to manipulate accounts.
          References
            DE.CM-03.03 Privileged account monitoring Mitigates T1098.001 Additional Cloud Credentials
            Comments
            This diagnostic statement implements mechanisms and tools to mitigate potential misuse of privileged users and accounts. Continuous monitoring of role and attribute assignments and activity is essential to prevent and detect unauthorized access or misuse.
            References
              PR.AA-01.02 Physical and logical access Mitigates T1098.001 Additional Cloud Credentials
              Comments
              This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts.
              References
                PR.AA-03.01 Authentication requirements Mitigates T1098.001 Additional Cloud Credentials
                Comments
                This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials.
                References
                  PR.IR-01.01 Network segmentation Mitigates T1098.001 Additional Cloud Credentials
                  Comments
                  This diagnostic statement is for the implementation of network segmentation which helps prevent access to critical systems and sensitive information. Employing proper network segmentation limits access to critical systems and domain controllers.
                  References
                    PR.IR-01.06 Production environment segregation Mitigates T1098.001 Additional Cloud Credentials
                    Comments
                    This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
                    References
                      PR.AA-01.01 Identity and credential management Mitigates T1098.001 Additional Cloud Credentials
                      Comments
                      This diagnostic statement protects against Additional Cloud Credentials through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                      References

                        NIST 800-53 Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        CM-06 Configuration Settings mitigates T1098.001 Additional Cloud Credentials
                        CM-05 Access Restrictions for Change mitigates T1098.001 Additional Cloud Credentials
                        IA-05 Authenticator Management mitigates T1098.001 Additional Cloud Credentials
                        SC-46 Cross Domain Policy Enforcement mitigates T1098.001 Additional Cloud Credentials
                        SI-07 Software, Firmware, and Information Integrity mitigates T1098.001 Additional Cloud Credentials
                        AC-20 Use of External Systems mitigates T1098.001 Additional Cloud Credentials
                        IA-02 Identification and Authentication (Organizational Users) mitigates T1098.001 Additional Cloud Credentials
                        CM-07 Least Functionality mitigates T1098.001 Additional Cloud Credentials
                        SI-04 System Monitoring mitigates T1098.001 Additional Cloud Credentials
                        AC-02 Account Management mitigates T1098.001 Additional Cloud Credentials
                        AC-03 Access Enforcement mitigates T1098.001 Additional Cloud Credentials
                        AC-04 Information Flow Enforcement mitigates T1098.001 Additional Cloud Credentials
                        AC-05 Separation of Duties mitigates T1098.001 Additional Cloud Credentials
                        AC-06 Least Privilege mitigates T1098.001 Additional Cloud Credentials
                        SC-07 Boundary Protection mitigates T1098.001 Additional Cloud Credentials

                        VERIS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        attribute.integrity.variety.Modify privileges Modified privileges or permissions related-to T1098.001 Additional Cloud Credentials

                        Azure Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        devops_security Microsoft Defender for Cloud: DevOps Security technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        This capability can protect against creation of additional cloud credentials by requiring DevOps best practices.
                        References
                        azure_policy Azure Policy technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        This control may recommend removing deprecated accounts, reducing privileges, and enabling multi-factor authentication. This can reduce the amount of accounts available to be exploited and what could be done with those accounts.
                        References
                        azure_role_based_access_control Azure Role-Based Access Control technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can modify accounts.
                        References

                        GCP Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        cloud_asset_inventory Cloud Asset Inventory technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        This control may be able to detect when adversaries use cloud accounts to elevate privileges through manipulation of IAM or access policies for the creation of additional accounts. This monitoring can be fine tuned to specific assets, policies, and organizations.
                        References
                        google_secops Google Security Operations technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        Google Security Ops is able to trigger an alert based on changes to Cloud Storage IAM permissions. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_gcs_iam_changes.yaral
                        References
                        identity_and_access_management Identity and Access Management technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        Privileged roles and permissions can be granted to entire groups of users by default, and admins can control unwanted access by utilizing machine learning to recommend smart access control permissions within an organization. This control can help mitigate adversaries from gaining access to unwanted account.
                        References
                        identity_aware_proxy Identity Aware Proxy technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. IAP lets you enforce access control policies for applications and resources. This control may help mitigate against adversaries gaining access through cloud account by the configuration of access controls and firewalls, allowing limited access to systems.
                        References
                        identity_platform Identity Platform technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        Identity Platform can help protect your app's users and prevent account takeovers by offering multi-factor authentication (MFA) and integrating with Google's intelligence for account protection. This will help mitigate adversaries from gaining access to permission levels.
                        References
                        policy_intelligence Policy Intelligence technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        Utilization and enforcement of MFA for user accounts to ensure that IAM policies are implemented properly shall mitigate adversaries so that they may not gain access to user accounts. Enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need.
                        References
                        resource_manager Resource Manager technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        GCP offers Identity and Access Management (IAM), which lets admins give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This allows configuration of access controls and firewalls to limit access to critical systems and domain controllers.
                        References
                        security_command_center Security Command Center technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        SCC ingests Cloud Audit logs to detect when permissions are changed in a privileged group (i.e., modify group to public) with sensitive permissions or roles. This security solution protects against compromised cloud accounts used to maintain persistence. Because of the near-real time temporal factor to detect against this cyber-attack the control was graded as significant.
                        References
                        vpc_service_controls VPC Service Controls technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        VPC further segments the environment by providing configurable granular access controls which help limit user permissions to communicate with critical systems.
                        References

                        AWS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        amazon_guardduty Amazon GuardDuty technique_scores T1098.001 Additional Cloud Credentials
                        Comments
                        The Persistence:IAMUser/AnomalousBehavior finding can detect anomalous API requests that can be used by adversaries to maintain persistence such as CreateAccessKey, ImportKeyPair.
                        References
                          aws_config AWS Config technique_scores T1098.001 Additional Cloud Credentials
                          Comments
                          The following AWS Config managed rules can identify configuration problems that should be fixed in order to ensure multi-factor authentication (MFA) is enabled properly, which can provide protection against attempted manipulation of cloud accounts: "iam-user-mfa-enabled", "mfa-enabled-for-iam-console-access", "root-account-hardware-mfa-enabled", and "root-account-mfa-enabled". All of these controls are run periodically and provide partial coverage, since adversaries may be able to manipulate cloud credentials via other mechanisms, resulting in an overall score of Partial.
                          References
                            aws_identity_and_access_management AWS Identity and Access Management technique_scores T1098.001 Additional Cloud Credentials
                            Comments
                            The Access Analyzer tool may detect when an external entity has been granted access to cloud resources through use of access policies. This tool will scan upon any change to access policies or periodically within 24 hours.
                            References
                              aws_security_hub AWS Security Hub technique_scores T1098.001 Additional Cloud Credentials
                              Comments
                              AWS Security Hub performs a check from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting the manipulation of accounts. AWS Security Hub provides this detection with the following check. 3.4 Ensure a log metric filter and alarm exist for IAM policy changes This is scored as Significant because it can monitor all changes to IAM policy which can be used to detect any changes made to accounts.
                              References