MITRE ATT&CKsub-technique

T1021.007 Cloud Services

Published 2023-02-21 Modified 2025-04-15 Official page ↗
Domain
enterprise
Tactics
Lateral Movement
Platforms
IaaS, Identity Provider, Office Suite, SaaS
Version
1.1
Created
2023-02-21

Description

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., Cloud API), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via Application Access Token instead of a username and password.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1021 Remote Services technique

Tactic · MITRE ATT&CK (1)

  • TA0008 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1032 Multi-factor Authentication mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (5)

  • S9043 Mini Shai-Hulud software (malware)
  • G1053 Storm-0501 group
  • G1015 Scattered Spider group
  • C0027 C0027 campaign
  • G0016 APT29 group

Referenced by Compliance · mitigates (11)

  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.4 Require MFA for Remote Network Access CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control