Skip to content

Cloud API

Subtechnique · ATTACK:enterprise:T1059.009

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1059.009",
  "title": "Cloud API",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1059/009",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--55bb4471-ff1f-43b4-88c1-c9384ec47abf",
  "external_id": "T1059.009",
  "domain": "enterprise",
  "created": "2022-03-17T13:28:24.989Z",
  "modified": "2026-05-12T15:12:00.634Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Microsoft - Azure PowerShell",
      "url": "https://github.com/Azure/azure-powershell"
    }
  ]
}

Explicit source assertions (11)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d2683e0-74e3-4858-b702-fdb4d7cf8a55

Microsoft Storm-0501 Embargo Ransomware August 2025

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70f8bdf6-13e0-408d-bd82-9f984bd6c67b

AI-Mexico-Govt-Breach

ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--752a6089-4d85-433e-994b-583c3f35c383

Github TruffleSecurity Trufflehog April 2025

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b42d990f-4fa7-40be-9018-73c75130fcfe

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc4b3d58-4a4c-43e4-94c5-bced84db2c97

Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf5fcae9-bc18-4278-bf0c-be7237a5d8eb

ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cea62da0-1d9f-40d8-adfb-ee40f6b1a345

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da4059ab-c858-4df1-94e0-25db2d6ea136

ATTACK:enterprise:T1059.009 → subtechnique-of → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc724053-6ac6-43c6-b24a-3e1234a973de

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfcb95e9-f3ce-46e4-aa7f-97c180a90c9d

AI-Mexico-Govt-Breach

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e736c1-5522-48fd-8e2c-06fef46199a8

MSTIC Nobelium Toolset May 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.