Cloud Accounts

T1586.003

Sub-technique of T1586 Compromise Accounts.View on attack.mitre.org

About this technique

Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for Exfiltration to Cloud Storage or to Upload Tools. Cloud accounts can also be used in the acquisition of infrastructure, such as Virtual Private Servers or Serverless infrastructure. Additionally, cloud-based messaging services such as Twilio, SendGrid, AWS End User Messaging, AWS SNS (Simple Notification Service), or AWS SES (Simple Email Service) may be leveraged for spam or Phishing. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.

A variety of methods exist for compromising cloud accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, conducting Password Spraying attacks, or attempting to Steal Application Access Tokens. Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a Trusted Relationship between service providers and their customers.

Detection rules36

Rules on DetectionCode tagged with T1586.003.

Sigma1

Rule	Level	Log source
Okta Suspicious Activity Reported by End-user	high	okta / NULL

Splunk35

Rule	Type	Risk	Data source
ASL AWS Credential Access GetPasswordData	Anomaly	NULL	ASL AWS CloudTrail
ASL AWS Credential Access RDS Password reset	TTP	NULL	ASL AWS CloudTrail
ASL AWS Multi-Factor Authentication Disabled	TTP	NULL	ASL AWS CloudTrail
AWS Console Login Failed During MFA Challenge	TTP	NULL	AWS CloudTrail ConsoleLogin
AWS Credential Access Failed Login	TTP	NULL	AWS CloudTrail ConsoleLogin
AWS Credential Access GetPasswordData	Anomaly	NULL	AWS CloudTrail GetPasswordData
AWS Credential Access RDS Password reset	TTP	NULL	AWS CloudTrail ModifyDBInstance
AWS Multi-Factor Authentication Disabled	TTP	NULL	AWS CloudTrail DeleteVirtualMFADevice, AWS CloudTrail DeactivateMFADevice
AWS Multiple Failed MFA Requests For User	Anomaly	NULL	AWS CloudTrail ConsoleLogin
AWS Successful Single-Factor Authentication	TTP	NULL	AWS CloudTrail ConsoleLogin
AWS Unusual Number of Failed Authentications From Ip	Anomaly	NULL	AWS CloudTrail ConsoleLogin
Azure Active Directory High Risk Sign-in	TTP	NULL	Azure Active Directory
Azure AD Authentication Failed During MFA Challenge	TTP	NULL	Azure Active Directory
Azure AD Multi-Factor Authentication Disabled	TTP	NULL	Azure Active Directory Disable Strong Authentication
Azure AD Multi-Source Failed Authentications Spike	Hunting	NULL	Azure Active Directory
Azure AD Multiple Failed MFA Requests For User	TTP	NULL	Azure Active Directory Sign-in activity
Azure AD Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Azure Active Directory
Azure AD Successful PowerShell Authentication	TTP	NULL	Azure Active Directory
Azure AD Successful Single-Factor Authentication	TTP	NULL	Azure Active Directory
Azure AD Unusual Number of Failed Authentications From Ip	Anomaly	NULL	Azure Active Directory
Detect AWS Console Login by New User	Hunting	NULL	AWS CloudTrail
Detect AWS Console Login by User from New City	Hunting	NULL	AWS CloudTrail
Detect AWS Console Login by User from New Country	Hunting	NULL	AWS CloudTrail
Detect AWS Console Login by User from New Region	Hunting	NULL	AWS CloudTrail
GCP Authentication Failed During MFA Challenge	TTP	NULL	Google Workspace login_failure
GCP Multi-Factor Authentication Disabled	TTP	NULL	Google Workspace
GCP Multiple Failed MFA Requests For User	TTP	NULL	Google Workspace
GCP Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Google Workspace
GCP Successful Single-Factor Authentication	TTP	NULL	Google Workspace
GCP Unusual Number of Failed Authentications From Ip	Anomaly	NULL	Google Workspace
O365 Multi-Source Failed Authentications Spike	Hunting	NULL	O365 UserLoginFailed
O365 Multiple Users Failing To Authenticate From Ip	TTP	NULL	O365 UserLoginFailed
Okta Authentication Failed During MFA Challenge	TTP	NULL	Okta
Okta Successful Single Factor Authentication	Anomaly	NULL	Okta
Okta User Logins from Multiple Cities	Anomaly	NULL	Okta

Groups2

APT-C-36 APT29

Software0

None recorded.

Campaigns1

APT41 DUST

Procedure examples3

Groups2

Used by	Procedure example
GroupAPT-C-36	APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization. Recorded Future TAG-144 AUG 2025
GroupAPT29	APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments. Mandiant APT29 Microsoft 365 2022

Campaigns1

Used by	Procedure example
CampaignAPT41 DUST	APT41 DUST used compromised Google Workspace accounts for command and control. Google Cloud APT41 2024

References4

Awake Security C2 Cloud Open source
Gary Golomb and Tory Kei. (n.d.). Threat Hunting Series: Detecting Command & Control in the Cloud. Retrieved May 27, 2022.
MSTIC Nobelium Oct 2021 Open source
Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022.
Netcraft SendGrid 2024 Open source
Graham Edgecombe. (2024, February 7). Phishception – SendGrid is abused to host phishing attacks impersonating itself. Retrieved October 15, 2024.
Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022 Open source
Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.