Temporary Elevated Cloud Access

{
  "id": "ATTACK:enterprise:T1548.005",
  "title": "Temporary Elevated Cloud Access",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1548/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--6fa224c7-5091-4595-bf15-3fc9fe2f2c7c",
  "external_id": "T1548.005",
  "domain": "enterprise",
  "created": "2023-07-10T16:37:15.672Z",
  "modified": "2026-05-12T15:12:00.641Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "AWS PassRole",
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html"
    },
    {
      "source_name": "CrowdStrike StellarParticle January 2022",
      "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
    },
    {
      "source_name": "Google Cloud Just in Time Access 2023",
      "url": "https://cloud.google.com/architecture/manage-just-in-time-privileged-access-to-project"
    },
    {
      "source_name": "Google Cloud Service Account Authentication Roles",
      "url": "https://cloud.google.com/iam/docs/service-account-permissions"
    },
    {
      "source_name": "Microsoft Impersonation and EWS in Exchange",
      "url": "https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/impersonation-and-ews-in-exchange"
    },
    {
      "source_name": "Azure Just in Time Access 2023",
      "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/approve-just-in-time-access"
    },
    {
      "source_name": "Rhino Security Labs AWS Privilege Escalation",
      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
    },
    {
      "source_name": "Rhino Google Cloud Privilege Escalation",
      "url": "https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/"
    },
    {
      "source_name": "Hunters Domain Wide Delegation Google Workspace 2023",
      "url": "https://www.hunters.security/en/blog/delefriend-a-newly-discovered-design-flaw-in-domain-wide-delegation-could-leave-google-workspace-vulnerable-for-takeover"
    },
    {
      "source_name": "Palo Alto Unit 42 Google Workspace Domain Wide Delegation 2023",
      "url": "https://unit42.paloaltonetworks.com/critical-risk-in-google-workspace-delegation-feature/"
    }
  ]
}