Additional Cloud Roles
Subtechnique · ATTACK:enterprise:T1098.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1098.003",
"title": "Additional Cloud Roles",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1098/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3",
"external_id": "T1098.003",
"domain": "enterprise",
"created": "2020-01-19T16:59:45.362Z",
"modified": "2025-10-24T17:48:35.082Z",
"version": "2.5",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "Expel AWS Attacker",
"url": "https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/"
},
{
"source_name": "Microsoft O365 Admin Roles",
"url": "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide"
},
{
"source_name": "AWS IAM Policies and Permissions",
"url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html"
},
{
"source_name": "Google Cloud IAM Policies",
"url": "https://cloud.google.com/iam/docs/policies"
},
{
"source_name": "Invictus IR DangerDev 2024",
"url": "https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me"
},
{
"source_name": "Microsoft Support O365 Add Another Admin, October 2019",
"url": "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d"
},
{
"source_name": "Rhino Security Labs AWS Privilege Escalation",
"url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2606e684-b69d-47fc-822f-279d197a1e7a
Microsoft Requests for Azure AD Roles in Privileged Identity ManagementATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e23f18f-9418-462d-9f59-a527cb15ba9d
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:T1098.003 → subtechnique-of → ATTACK:enterprise:T1098
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cb81e24-b3b8-4a56-b153-3247193de120
ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dfb4403-9368-4fed-aac0-a968e7761c4a
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80e8fae3-0b15-4e5b-bd69-af76dd3e5864
CrowdStrike StellarParticle January 2022ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93c5ae98-040a-453a-a90c-247972f8d0bc
MSTIC Octo Tempest Operations October 2023ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bbd4f6df-b4e4-4e8e-8811-41212aef6264
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e336149c-2d17-4be0-96e2-a99e6e278102
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9a0a532-21a6-47a2-83f8-4abb61cb3fc7