Cloud Accounts
Subtechnique · ATTACK:enterprise:T1078.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1078.004",
"title": "Cloud Accounts",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1078/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65",
"external_id": "T1078.004",
"domain": "enterprise",
"created": "2020-03-13T20:36:57.378Z",
"modified": "2026-05-12T15:12:00.723Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"persistence",
"privilege-escalation",
"initial-access"
],
"source_references": [
{
"source_name": "AWS Identity Federation",
"url": "https://aws.amazon.com/identity/federation/"
},
{
"source_name": "SpecterOps Managed Identity 2022",
"url": "https://posts.specterops.io/managed-identity-attack-paths-part-1-automation-accounts-82667d17187a?gi=6a9daedade1c"
},
{
"source_name": "Google Federating GC",
"url": "https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction"
},
{
"source_name": "Microsoft Deploying AD Federation",
"url": "https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs"
}
]
}Explicit source assertions (31)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00fe17bc-f783-4cba-9171-e1fde2fa0efa
CrowdStrike StellarParticle January 2022ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--124e7a8b-5bc6-499d-8ca5-4c25b3ed8602
AWS - IAM Console Best PracticesATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14039b88-3e1f-4d21-a0a0-968a15451db1
ATTACK:enterprise:T1078.004 → subtechnique-of → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bccb381-1d71-4c9a-8785-2ada562234f2
ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44ba0ff1-3858-4b2e-933d-e5dc00b4ca27
Mandiant APT29 Microsoft 365 2022 · Mandiant APT29 Eye Spy Email Nov 22ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dbb52bd-9ecf-4c61-91b2-9787860f737c
TechNet Credential Theft · TechNet Least Privilege · Microsoft Azure security baseline for Azure Active Directory · Microsoft Security Alerts for Azure AD RolesATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--570b767f-bf48-4902-aae8-9510dcad5bfc
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--619c6c5c-fd82-4d38-b55b-b7eb0678cda7
Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Palo Alto Unit 42 Shai-Hulud November 2025 · Wiz Shai-Hulud September 2025 · Microsoft Shai-Hulud December 2025ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6370e4b2-a26e-489f-a444-3d32991c0783
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:S0684 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64fe5b69-1b3b-44a3-a952-0dc22091ea3a
RoadtoolsATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65001ff0-a5e7-4aee-8abc-9fa4e02cb0a8
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz Mini Shai-Hulud MAY 2026 · Wiz TeamPCP KICS MAR 2026 · Trend Micro TeamPCP MAY 2026 · Palo Alto TeamPCP MAR 2026 · Phoenix TeamPCP 20 MAY 2026ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68ad793a-2678-4537-8480-8086fd4d757e
AWS - IAM Console Best PracticesATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72f52cf0-dc68-4a4b-8025-724b2691c449
Cybersecurity Advisory GRU Brute Force Campaign July 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fd8e4e2-baaf-4a2a-9c4e-31f5a759978f
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86c9276e-1144-42b9-971f-8ba4eefec3be
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8afa26f2-4df2-4d97-b2c8-747683443803
Intel471_SH_Aug2021 · Unit42KelleyVaya_BlingLibra_Aug2024 · SOCRadar_ShinyHunters_Mar2024ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ca6d3b2-eb89-466f-910c-49b18fe78add
CERT PolskaATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae75eacd-4727-40e0-a781-146aa8c1e730
Palo Alto VOID MANTICORE Iran Cyber Threats March 2026 · SEC 8-K Stryker Corporation Filing Handala Hack March 2026ATTACK:enterprise:M1036 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b93fd13f-b11b-4f4b-9d77-977e7af41d5c
Microsoft Common Conditional Access PoliciesATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0dc2f42-32e5-40ab-a0b6-f259303834d6
Trend Micro TeamPCP MAY 2026ATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c37d24cf-8ea8-4212-831e-bc3f37c10893
Peirates GitHubATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c43e411a-6615-47f5-ba14-b62c78a61572
ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc12f7b7-05a6-4078-b9b5-411e2a2836ba
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1c33c8e-3962-4815-aeb4-c5e4f6756d87
MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd4d5a0f-5b10-4062-a099-690eb57839fc
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de08b4d6-06a5-441f-aafe-5cb505136efe
CrowdStrike Scattered Spider JUL 2025ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e47bf587-4bac-4f6b-ac2b-9ca462e95d0a
GitHub PacuATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e93a3bf7-2ca4-42ed-872a-f9f0f8458936
Microsoft Holmium June 2020ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec5caf8f-0fb8-4c3b-bd31-08804ff2214e
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7ed42df-01c4-4441-95ce-68228e157abf
Microsoft NICKEL December 2021ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff397dfb-a231-423f-8be0-be01eb2c9d4d