Additional Cloud Credentials

{
  "id": "ATTACK:enterprise:T1098.001",
  "title": "Additional Cloud Credentials",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1098/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--8a2f40cf-8325-47f9-96e4-b1ca4c7389bd",
  "external_id": "T1098.001",
  "domain": "enterprise",
  "created": "2020-01-19T16:10:15.008Z",
  "modified": "2026-09-17T17:49:30.904Z",
  "version": "2.8",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Crowdstrike AWS User Federation Persistence",
      "url": "https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/"
    },
    {
      "source_name": "Expel IO Evil in AWS",
      "url": "https://expel.io/blog/finding-evil-in-aws/"
    },
    {
      "source_name": "SpecterOps Azure Privilege Escalation",
      "url": "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5"
    },
    {
      "source_name": "Demystifying Azure AD Service Principals",
      "url": "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/"
    },
    {
      "source_name": "Lacework AI Resource Hijacking 2024",
      "url": "https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts"
    },
    {
      "source_name": "GCP SSH Key Add",
      "url": "https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add"
    },
    {
      "source_name": "Permiso Scattered Spider 2023",
      "url": "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud"
    },
    {
      "source_name": "Blue Cloud of Death Video",
      "url": "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815"
    },
    {
      "source_name": "Blue Cloud of Death",
      "url": "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1"
    },
    {
      "source_name": "Microsoft Entra ID App Passwords",
      "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords"
    },
    {
      "source_name": "Microsoft SolarWinds Customer Guidance",
      "url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
    },
    {
      "source_name": "Mandiant APT42-untangling",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
    },
    {
      "source_name": "Expel Behind the Scenes",
      "url": "https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/"
    },
    {
      "source_name": "Sysdig ScarletEel 2.0",
      "url": "https://sysdig.com/blog/scarleteel-2-0/"
    },
    {
      "source_name": "Rhino Security Labs AWS Privilege Escalation",
      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
    }
  ]
}