Establish Accounts: Cloud Accounts T1585.003

Tactic: Resource Development

Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for Exfiltration to Cloud Storage or to Upload Tools. Cloud accounts can also be used in the acquisition of infrastructure, such as Virtual Private Servers or Serverless infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
AADOperationType1eq 1Add
DomainAdded1contains 1onmicrosoft
OperationName1in 1Add unverified domain, Add verified domain
Result1eq 1success

Top indicator values (5 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
AADOperationTypeeq
Add
1
DomainAddedcontains
onmicrosoft
1
OperationNamein
Add unverified domain
1
OperationNamein
Add verified domain
1
Resulteq
success
131

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Azure

Domain: Identity

Kusto 1 rule