Account Manipulation: Additional Cloud Credentials

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Adversaries may add credentials for Azure Service Principals in addition to existing legitimate credentials[1] to victim Azure accounts.[2][3] Azure Service Principals support both password and certificate credentials.[4] With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.[5]

After gaining access through Cloud Accounts, adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.[6] This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.[7][8]

ID: T1098.001
Sub-technique of:  T1098
Tactic: Persistence
Platforms: AWS, Azure, Azure AD, GCP
Permissions Required: Administrator, User
Data Sources: AWS CloudTrail logs, Azure activity logs, GCP audit logs, Stackdriver logs
Contributors: Expel; Jannie Li, Microsoft Threat Intelligence Center (MSTIC); Oleg Kolesnikov, Securonix
Version: 2.0
Created: 19 January 2020
Last Modified: 05 October 2020

Mitigations

Mitigation Description
Multi-factor Authentication

Use multi-factor authentication for user and privileged accounts. Consider enforcing multi-factor authentication for the CreateKeyPair and ImportKeyPair API calls through IAM policies.[7]

Network Segmentation

Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

Privileged Account Management

Do not allow domain administrator or root accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Detection

Monitor Azure Activity Logs for service principal modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.

Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.

References