Cross-account role abuse

Roles trusted across accounts or tenants assumed to pivot

categoryCloud, container and supply chain attacksseverityHighdetectabilityHighlabnot yet measured

Classification

36 values: 13 reviewed, 21 imported, 2 derived. What do these mean?

Exploitability

Attack vector	Credential attacksSupply chain
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	IaaSIdentity ProviderLinuxmacOSOffice SuiteSaaSWindows
Environment	Cloud
Target asset class	Identity
Kill-chain phase (tactic)	Initial AccessPersistencePrivilege EscalationStealth

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentLogon Session CreationLogon Session MetadataNetwork Connection CreationNetwork Traffic ContentUser Account Authentication
Attack permissions (ATT&CK)	AdministratorUser

Detection & response

Mitigated by 26

M1015 attack-mitigation
M1017 attack-mitigation
M1018 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1030 attack-mitigation
M1032 attack-mitigation
M1036 attack-mitigation
D3-AA d3fend
D3-AL d3fend
D3-AM d3fend
D3-APCA d3fend
D3-CAA d3fend
D3-CDP d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-RUAA d3fend
D3-ST d3fend
D3-UAP d3fend
D3-UGLPA d3fend
D3-ULA d3fend

Detected by 45

DET0488 attack-detection-strategy
DET0546 attack-detection-strategy
0055ad1f-be85-4798-83cf-a6da17c993b3 sigma
039a7469-0296-4450-84c0-f6966b16dc6d sigma
09438caa-07b1-4870-8405-1dbafe3dad95 sigma
0b4b72e3-4c53-4d5b-b198-2c58cfef39a9 sigma
11c767ae-500b-423b-bae3-b234450736ed sigma
1b45b0d1-773f-4f23-aedc-814b759563b1 sigma
28870ae4-6a13-4616-bd1a-235a7fad7458 sigma
28eea407-28d7-4e42-b0be-575d5ba60b2c sigma
2f575940-d85e-4ddc-af13-17dad6f1a0ef sigma
313e72de-0c0d-4d65-8c95-87f4d546eceb sigma
340ee172-4b67-4fb4-832f-f961bdc1f3aa sigma
38360161-76c4-4283-842e-efcf997dafc8 sigma
49a268a4-72f4-4e38-8a7b-885be690c5b5 sigma
4afac85c-224a-4dd7-b1af-8da40e1c60bd sigma
4d136857-6a1a-432a-82fc-5dd497ee5e7c sigma
4f77e1d7-3982-4ee0-8489-abf2d6b75284 sigma
53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc sigma
5496ff55-42ec-4369-81cb-00f417029e25 sigma
5afa454e-030c-4ab4-9253-a90aa7fcc581 sigma
5f521e4b-0105-4b72-845b-2198a54487b9 sigma
60f6535a-760f-42a9-be3f-c9a0a025906e sigma
70ed1d26-0050-4b38-a599-92c53d57d45a sigma
77caf516-34e5-4df9-b4db-20744fea0a60 sigma
8ad1600d-e9dc-4251-b0ee-a65268f29add sigma
8c944ecb-6970-4541-8496-be554b8e2846 sigma
8dee7a0d-43fd-4b3c-8cd1-605e189d195e sigma
908655e0-25cf-4ae1-b775-1c8ce9cf43d8 sigma
9a60e676-26ac-44c3-814b-0c2a8b977adf sigma
a0413867-daf3-43dd-9245-734b3a787942 sigma
a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9 sigma
b4a6d707-9430-4f5f-af68-0337f52d5c42 sigma
ccd6a6c8-bb4e-4a91-9d2a-07e632819374 sigma
db014773-7375-4f4e-b83b-133337c0ffee sigma
db014773-b1d3-46bd-ba26-133337c0ffee sigma
db014773-d9d9-4792-91e5-133337c0ffee sigma
db6c06c4-bf3b-421c-aa88-15672b88c743 sigma
e40f4962-b02b-4192-9bfe-245f7ece1f99 sigma
f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 sigma
… and 5 more in the database

Tested by 3

348f4d14-4bd3-4f6b-bd8a-61237f78b3ac atomic
3a159042-69e6-4398-9a69-3308a4841c85 atomic
9fdd83fd-bd53-46e5-a716-9dec89c8ae8e atomic

Attack relationships

Parent: Compromised insider
Parent: Vendor credential abuse

Framework references

Primary source: https://attack.mitre.org/techniques/T1078/004/
attack: T1078.004 (primary)
attack: T1199

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cloud, container and supply chain attacks' table, line 392 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 13 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 21 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)