Command and Scripting Interpreter: Cloud API

Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell[1], or software developer kits (SDKs) available for languages such as Python.

Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.

With proper permissions (often via use of credentials such as Application Access Token and Web Session Cookie), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.

ID: T1059.009
Sub-technique of:  T1059
Tactic: Execution
Platforms: Azure AD, Google Workspace, IaaS, Office 365, SaaS
Contributors: Caio Silva; Jason Sevilla; Marcus Weeks; Nichols Jasper; Ozan Olali
Version: 1.0
Created: 17 March 2022
Last Modified: 14 April 2023

Procedure Examples

ID Name Description
G0016 APT29

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API [2]

S1091 Pacu

Pacu leverages the AWS CLI for its operations.[3]

G0139 TeamTNT

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.[4]


ID Mitigation Description
M1038 Execution Prevention

Use application control where appropriate to block use of PowerShell CmdLets or other host based resources to access cloud API resources.

M1026 Privileged Account Management

Use of proper Identity and Access Management (IAM) with Role Based Access Control (RBAC) policies to limit actions administrators can perform and provide a history of administrative actions to detect unauthorized use and abuse.


ID Data Source Data Component Detects
DS0017 Command Command Execution

Consider reviewing command history in either host machines or cloud audit logs to determine if unauthorized or suspicious commands were executed.

Cloud API activity logging is typically enabled by default and may be reviewed in sources like the Microsoft Unified Audit Log, AWS CloudTrail, and GCP Admin Acitivty logs. Review these sources for history of executed API commands. Host logs may also be reviewed to capture CLI commands or PowerShell module usage to invoke Cloud API functions.