Cloud Account

Subtechnique · ATTACK:enterprise:T1136.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1136.003",
  "title": "Cloud Account",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1136/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a009cb25-4801-4116-9105-80a91cf15c1b",
  "external_id": "T1136.003",
  "domain": "enterprise",
  "created": "2020-01-29T17:32:30.711Z",
  "modified": "2025-10-24T17:49:09.917Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Microsoft O365 Admin Roles",
      "url": "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide"
    },
    {
      "source_name": "AWS Create IAM User",
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html"
    },
    {
      "source_name": "AWS Lambda Execution Role",
      "url": "https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    },
    {
      "source_name": "AWS Instance Profiles",
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html"
    },
    {
      "source_name": "GCP Create Cloud Identity Users",
      "url": "https://support.google.com/cloudidentity/answer/7332836?hl=en&ref_topic=7558554"
    },
    {
      "source_name": "GCP Service Accounts",
      "url": "https://cloud.google.com/iam/docs/service-account-overview"
    },
    {
      "source_name": "Microsoft Azure AD Users",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory"
    },
    {
      "source_name": "Microsoft Entra ID Service Principals",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser"
    },
    {
      "source_name": "Microsoft Support O365 Add Another Admin, October 2019",
      "url": "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d"
    }
  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.