Account Manipulation: Additional Cloud Roles `T1098.003`

Tactics: Persistence, Privilege Escalation

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Authoring guide

These 111 rules share fields, values, and exclusions.

Fields filtered most (98 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`aws::eventName`	29	`in` 25, `eq` 4	`AttachGroupPolicy`, `AttachRolePolicy`, `AttachUserPolicy`, `PutGroupPolicy`, `PutRolePolicy`
`data_stream.dataset`	29	`eq` 29	`aws.cloudtrail`, `azure.auditlogs`, `gcp.audit`, `google_workspace.admin`, `o365.audit`
`EventType`	28	`eq` 23, `in` 2, `wildcard` 2, `starts_with` 1	`group.privilege.grant`, `org.add_member`, `Add`, `Attach`, `AttachGroupPolicy`
`aws::errorCode`	28	`is_null` 26, `eq` 1, `is_not_null` 1	`accessdenied`
`aws::errorMessage`	26	`is_null` 26
`Action`	22	`contains` 22	`kms:delete`, `cloudformation:`, `cloudformation:create`, `cloudformation:createstack`, `datapipeline:*`
`Condition`	22	`eq` 20, `is_null` 2
`Effect`	22	`eq` 22	`allow`
`Resource`	22	`eq` 22	`*`
`event.outcome`	21	`eq` 21	`success`
`sourcetype`	19	`eq` 19	`azure:monitor:aad`, `o365:management:activity`
`Provider_Name`	14	`eq` 13, `in` 1	`iam.amazonaws.com`, `rolesanywhere.amazonaws.com`, `exchange`, `onedrive`, `sharepoint`
`operationName`	13	`eq` 11, `starts_with` 2, `contains` 1	`add member to role`, `add app role assignment to service principal`, `MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE`, `User has elevated their access to User Access Administrator`, `add eligible member to role in pim completed`
`EventID`	10	`eq` 10	`Add member to role`, `Add member to role.`, `ASSIGN_ROLE`, `Add member to role outside of PIM (permanent)`, `Add user`
`Operation`	9	`eq` 6, `in` 3	`add member to role.`, `update application.`, `add app role assignment to service principal.`, `add eligible member to role.`, `add application.`

Top indicator values (304 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Effect`	`eq`	`allow` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy +7 more rules	22	26
`Resource`	`eq`	`*` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy +7 more rules	22	23
`event.outcome`	`eq`	`success` elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Assume Role Policy Update elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User elasticAWS IAM Roles Anywhere Profile Creation elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS STS AssumeRoot by Rare User and Member Account elasticAzure Event Hub Authorization Rule Created or Updated elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified +6 more rules	21	375
`aws::eventName`	`in`	`AttachGroupPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachRolePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachUserPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`CreatePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`CreatePolicyVersion` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`PutGroupPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutRolePolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutUserPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`Action`	`contains`	`iam:*` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Action`	`contains`	`iam:passrole` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Action`	`contains`	`kms:delete` kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy	3	3
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Assume Role Policy Update elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Roles Anywhere Profile Creation elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS STS AssumeRoot by Rare User and Member Account	10	173
`data_stream.dataset`	`eq`	`azure.auditlogs` elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Global Administrator Role Assigned elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified	4	26
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP IAM Custom Role Creation elasticGCP IAM Service Account Impersonation Role Granted elasticGCP Storage Bucket Permissions Modification	3	69
`data_stream.dataset`	`eq`	`google_workspace.admin` elasticGoogle Workspace Admin Role Assigned to a User or Group elasticGoogle Workspace Custom Admin Role Created elasticGoogle Workspace User Organizational Unit Changed	3	17
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 Exchange Management Group Role Assigned elasticM365 Identity Global Administrator Role Assigned elasticM365 SharePoint Site Administrator Added	3	47
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD Admin Consent Bypassed by Service Principal splunkAzure AD Application Administrator Role Assigned splunkAzure AD FullAccessAsApp Permission Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD PIM Role Assigned splunkAzure AD PIM Role Assignment Activated splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal splunkAzure AD Service Principal Privilege Escalation splunkAzure AD Tenant Wide Admin Consent Granted	10	47
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Mailbox Read Access Granted to Application splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal Privilege Escalation splunkO365 Tenant Wide Admin Consent Granted	9	80
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Assume Role Policy Update elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell	9	32
`Workload`	`eq`	`azureactivedirectory` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal	6	30
`security_result.action`	`eq`	`ALLOW` chronicleEntra ID Add User Outside PIM chronicleEntra ID Add User To Admin Role chronicleEntra ID Recently Created User Assigned an Entra ID Role chronicleGCP Admin Privileged Roles Added To Service Accounts chronicleO365 Add User To Admin Role chronicleO365 Recently Created Entra ID User Assigned Roles	6	102
`operationName`	`eq`	`add member to role` sigmaUser Added to an Administrator's Azure AD Role splunkAzure AD Application Administrator Role Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal	5	6
`Category`	`eq`	`applicationmanagement` kusto[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions kusto[Entra ID] Application Granted Administrative Permission to Assign Microsoft Entra ID Roles kustoAdmin promotion after Role Management Application Permission Grant kustoMicrosoft Entra ID Role Management Permission Grant	4	13
`PermissionGrant`	`contains`	`rolemanagement.readwrite.directory` kusto[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions kusto[Entra ID] Application Granted Administrative Permission to Assign Microsoft Entra ID Roles kustoAdmin promotion after Role Management Application Permission Grant kustoMicrosoft Entra ID Role Management Permission Grant	4	4
`azure_ad::logged_by_service`	`eq`	`core directory` kusto[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions kusto[Entra ID] Application Granted Administrative Permission to Assign Microsoft Entra ID Roles kustoAdmin promotion after Role Management Application Permission Grant kustoMicrosoft Entra ID Role Management Permission Grant	4	11
`isprvilegedadrole`	`eq`	`true` splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal	4	4
`aws::requestParameters`	`contains`	`policyarn=arn:aws:iam::aws:policy/administratoraccess` elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User	3	3

Exclusions (16 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`pulumi` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM Assume Role Policy Update elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User	4
`aws::userAgent`	`contains`	`terraform` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM Assume Role Policy Update elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User	4
`aws::userAgent`	`contains`	`ansible` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM Inline Policy Added to a Group	2
`aws::requestParameters`	`contains`	`sourcetype=aws_acm_pca` elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA	1
`aws::sourceIPAddress`	`in`	`cloudformation.amazonaws.com` elasticAWS IAM Inline Policy Added to a Group	1
`aws::sourceIPAddress`	`in`	`servicecatalog.amazonaws.com` elasticAWS IAM Inline Policy Added to a Group	1
`aws::userIdentity.arn`	`contains`	`ansible` elasticAWS IAM Inline Policy Added to a Group	1
`aws::userIdentity.arn`	`contains`	`pulumi` elasticAWS IAM Inline Policy Added to a Group	1
`aws::userIdentity.arn`	`contains`	`terraform` elasticAWS IAM Inline Policy Added to a Group	1
`aws::userIdentity.type`	`eq`	`awsservice` elasticAWS IAM Inline Policy Added to a Group	1
`policyArn`	`contains`	`admin` kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	1
`policyArn`	`contains`	`fullaccess` kustoAWSCloudTrail - Privilege escalation with admin managed policy	1
`policyArn`	`starts_with`	`arn:aws:iam::aws:policy/AdministratorAccess` kustoAWSCloudTrail - Privilege escalation with admin managed policy	1
`source.as.organization.name`	`starts_with`	`AMAZON` elasticAWS IAM Inline Policy Added to a Group	1
`source.as.organization.name`	`starts_with`	`Amazon` elasticAWS IAM Inline Policy Added to a Group	1

Account Manipulation: Additional Cloud Roles `T1098.003`

Authoring guide

Fields filtered most (98 distinct)

Top indicator values (304 distinct)

Exclusions (16 distinct)

Rules under this technique

Sigma 9 rules

Elastic 32 rules

Splunk 19 rules

Kusto 31 rules

YARA-L 9 rules

Panther 11 rules

Account Manipulation: Additional Cloud Roles T1098.003

Authoring guide

Fields filtered most (98 distinct)

Top indicator values (304 distinct)

Exclusions (16 distinct)

Rules under this technique

Sigma 9 rules

Elastic 32 rules

Splunk 19 rules

Kusto 31 rules

YARA-L 9 rules

Panther 11 rules

Account Manipulation: Additional Cloud Roles `T1098.003`