Valid Accounts: Cloud Accounts

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud or be hybrid joined between on-premises systems and the cloud through federation with other identity sources such as Windows Active Directory. [1][2][3]

Service or user accounts may be targeted by adversaries through Brute Force, Phishing, or various other means to gain access to the environment. Federated accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments.

An adversary may create long lasting Additional Cloud Credentials on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication.

Cloud accounts may also be able to assume Temporary Elevated Cloud Access or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through Cloud API or other methods.

ID: T1078.004
Sub-technique of:  T1078
Platforms: Azure AD, Google Workspace, IaaS, Office 365, SaaS
Permissions Required: Administrator, User
Contributors: Jon Sternstein, Stern Security
Version: 1.6
Created: 13 March 2020
Last Modified: 16 October 2023

Procedure Examples

ID Name Description
G0007 APT28

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.[4]

G0016 APT29

APT29 has gained access to a global administrator account in Azure AD and has used Service Principal credentials in Exchange.[5][6]

G0064 APT33

APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.[7]

C0027 C0027

During C0027, Scattered Spider leveraged compromised credentials from victim users to authenticate to Azure tenants.[8]

G0004 Ke3chang

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.[9]

G1004 LAPSUS$

LAPSUS$ has used compromised credentials to access cloud assets within a target organization.[10]

S1091 Pacu

Pacu leverages valid cloud accounts to perform most of its operations.[11]

S0683 Peirates

Peirates can use stolen service account tokens to perform its operations.[12]

S0684 ROADTools

ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.[13]

C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.[14]

Mitigations

ID Mitigation Description
M1036 Account Use Policies

Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.[15]

M1015 Active Directory Configuration

Disable legacy authentication, which does not support MFA, and require the use of modern authentication protocols instead.

M1032 Multi-factor Authentication

Use multi-factor authentication for cloud accounts, especially privileged accounts. This can be implemented in a variety of forms (e.g. hardware, virtual, SMS), and can also be audited using administrative reporting features.[16]

M1027 Password Policies

Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge. Cloud service providers may track access key age to help audit and identify keys that may need to be rotated.[16]

M1026 Privileged Account Management

Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access, such as Global Administrator and Privileged Role Administrator in Azure AD.[17][18][19] These reviews should also check if new privileged cloud accounts have been created that were not authorized. For example, in Azure AD environments configure alerts to notify when accounts have gone many days without using privileged roles, as these roles may be able to be removed.[20] Consider using temporary, just-in-time (JIT) privileged access to Azure AD resources rather than permanently assigning privileged roles.[19]

M1018 User Account Management

Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts.

M1017 User Training

Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.

Detection

ID Data Source Data Component Detects
DS0028 Logon Session Logon Session Creation

Monitor for suspicious account behavior across cloud services that share account.

Logon Session Metadata

Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

DS0002 User Account User Account Authentication

Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account, account usage at atypical hours, or account authentication from unexpected locations or IP addresses. Service accounts should only be accessible from IP addresses from within the cloud environment.[21] For example, in Azure AD environments, consider using Identity Protection to flag risky sign-ins based on location, device compliance, and other factors.

References