Account Manipulation: Additional Cloud Credentials T1098.001

Tactics: Persistence, Privilege Escalation

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Authoring guide

These 59 rules share fields, values, and exclusions.

Fields filtered most (84 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType20eq 12, in 5, is_not_null 1, starts_with 1, wildcard 1createaccesskey, createloginprofile, updateloginprofile, Add, Attach
data_stream.dataset19eq 19aws.cloudtrail, azure.auditlogs, azure.signinlogs, azure.activitylogs, gcp.audit
event.outcome16eq 16success
Provider_Name11eq 11iam.amazonaws.com, rds.amazonaws.com, sts.amazonaws.com
aws::eventName8eq 6, in 2createaccesskey, createapikey, AddRoleToDBCluster, AddRoleToDBInstance, CreateAccessKey
EventID6eq 4, regex_match 3Update application.*Certificates and secrets management, Add application., Add delegated permission grant., Update application., google.iam.admin.v1.CreateServiceAccountKey
aws::errorCode5eq 3, is_not_null 1, is_null 1accessdenied
event.dataset5eq 5github.audit, aws.cloudtrail
aws::eventSource4eq 4iam.amazonaws.com, rds.amazonaws.com
security_result.action4eq 4ALLOW
type4eq 4admin_api_key_created, admin_api_key_deleted, service_key_created, service_key_revoked
aws::userIdentity.type3eq 3AssumedRole, Root, iamuser
azure_ad::activity_display_name3eq 2, contains 1add eligible member to role, add member to role, add service principal credentials, update application - certificates and secrets management
OperationName2contains 1, eq 1add service principal, certificates and secrets management, invite external user, redeem external user invite, update application
action2eq 1, in 1DeleteUserRole, UpdateUserRole, org.remove_outside_collaborator, project.update_user_permission

Top indicator values (167 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.outcomeeq
success
16375
Provider_Nameeq
iam.amazonaws.com
932
data_stream.dataseteq
aws.cloudtrail
8173
data_stream.dataseteq
azure.auditlogs
326
data_stream.dataseteq
azure.signinlogs
236
security_result.actioneq
ALLOW
4102
EventIDregex_match
Update application.*Certificates and secrets management
33
aws::errorCodeeq
accessdenied
316
aws::eventSourceeq
iam.amazonaws.com
328
event.dataseteq
github.audit
314
event.dataseteq
aws.cloudtrail
217
EventTypeeq
createaccesskey
22
EventTypein
createaccesskey
24
EventTypein
createloginprofile
22
EventTypein
updateloginprofile
22
aws::eventNameeq
createaccesskey
26
aws::eventNameeq
createapikey
22
event.categoryeq
configuration
213
github.programmatic_access_typein
fine-grained personal access token
26
github.programmatic_access_typein
oauth access token
26
AADOperationTypein
assign
13
AADOperationTypein
assigneligiblerole
13
AppNamestarts_with
ConnectSyncProvisioning_
12
AwsSecurityFindingGeneratorIdeq
security-control/IAM.4
1
Categoryeq
rolemanagement
121
Categoryeq
usermanagement
111
ComplianceSecurityControlIdeq
IAM.4
1
ComplianceStatuseq
FAILED
18
Esql.aws_cloudtrail_created_access_key_use_countgt
0
1
Esql.aws_cloudtrail_self_access_key_creation_countgt
0
1

Exclusions (25 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
aws::userAgentcontains
pulumi
3
aws::userAgentcontains
terraform
3
aws::userAgentcontains
ansible
2
aws::errorCodeeq
accessdenied
1
aws::requestParameterscontains
username=
1
aws::sourceIPAddressin
cloudformation.amazonaws.com
1
aws::sourceIPAddressin
servicecatalog.amazonaws.com
1
aws::userIdentity.arncontains
ansible
1
aws::userIdentity.arncontains
pulumi
1
aws::userIdentity.arncontains
terraform
1
aws::userIdentity.typeeq
awsservice
1
azure.signinlogs.properties.app_owner_tenant_ideq
f8cdef31-a31e-4b4a-93e4-5f571e91255a
1
azure.signinlogs.properties.app_owner_tenant_idin
72f988bf-86f1-41af-91ab-2d7cd011db47
1
azure.signinlogs.properties.app_owner_tenant_idin
f8cdef31-a31e-4b4a-93e4-5f571e91255a
1
azure_ad::app_idin
00000003-0000-0ff1-ce00-000000000000
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 8 rules

Elastic 26 rules

Splunk 2 rules

Kusto 5 rules

YARA-L 6 rules

Panther 12 rules