Cross-source coverage

T1136.003 / ATT&CK

Create Account: Cloud Account

50 rules across 8 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment. In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for Temporary Elevated Cloud Access. While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.

Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.

Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding Additional Cloud Credentials or assigning Additional Cloud Roles.

Tactics: Persistence
Platforms: IaaS · SaaS · Office Suite · Identity Provider
Telemetry: azure:auditazure:signinlogsAWS:CloudTrailsaas:zoomm365:unified

How MITRE says to detect it DET0319

Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office

Identity Provider Analytic 0899

Adversaries create user accounts via identity provider APIs or admin portals (e.g., Azure AD, Okta). These accounts may be assigned elevated privileges or used in chained authentication. Detection monitors Add User activity from suspicious IPs or automation sources, followed by role/permission escalation.

azure:audit Add user
azure:audit Add member to role
azure:signinlogs Login from newly created account

IaaS Analytic 0900

Adversaries use cloud API, CLI, or console to create IAM users or roles. Initial CreateUser is followed by policy/role attachment. Detection monitors temporal chains involving IAM:CreateUser, AttachUserPolicy, and credential generation, especially from automation or foreign IP ranges.

AWS:CloudTrail CreateUser
AWS:CloudTrail AttachUserPolicy

SaaS Analytic 0901

Adversaries create SaaS accounts via admin dashboards or integrations (e.g., Zoom, Salesforce, Slack). Monitor lifecycle.create or account provisioning events from non-standard sources or times.

saas:zoom New user created

Office Suite Analytic 0902

Adversaries leverage M365 or Google Workspace APIs to create users, service accounts, or guest accounts. Follow-on behaviors include login activity, role escalation, or service principal token generation.

m365:unified Add user
m365:unified Add member to group

View on attack.mitre.org ↗

splunk/security_content

20 rules

Detection	Severity	Format
ASL AWS Create Access Key	Undefined	SPL
ASL AWS UpdateLoginProfile	Undefined	SPL
AWS CreateAccessKey	Undefined	SPL
AWS CreateLoginProfile	Undefined	SPL
AWS UpdateLoginProfile	Undefined	SPL
Azure AD External Guest User Invited	Undefined	SPL
Azure AD Multiple Service Principals Created by SP	Undefined	SPL
Azure AD Multiple Service Principals Created by User	Undefined	SPL
Azure AD Service Principal Created	Undefined	SPL
Azure Automation Account Created	Undefined	SPL

+ 10 more from splunk/security_content → showing the 10 highest-severity

elastic/detection-rules

9 rules

Detection	Severity	Format
AWS IAM Create User via Assumed Role on EC2 Instance	High	Elastic TOML
AWS IAM Sensitive Operations via Lambda Execution Role	High	Elastic TOML
AWS Sensitive IAM Operations Performed via CloudShell	High	Elastic TOML
New GitHub Owner Added	Medium	Elastic TOML
AWS IAM Group Creation	Low	Elastic TOML
Entra ID External Guest User Invited	Low	Elastic TOML
Entra ID Service Principal Created	Low	Elastic TOML
GCP Service Account Creation	Low	Elastic TOML
New GitHub Personal Access Token (PAT) Added	Low	Elastic TOML

panther-labs/panther-analysis

8 rules

Detection	Severity	Format
Crowdstrike Ephemeral User Account	High	Panther Python
Crowdstrike New Admin User Created	High	Panther Python
GCP Inbound SSO Profile Created	High	Panther Python
GCP Workforce Pool Created or Updated	High	Panther Python
GCP Workload Identity Pool Created or Updated	High	Panther Python
ZIA Cloud Account Created	Medium	Panther Python
Wiz User Created Or Deleted	Low	Panther Python
Crowdstrike New User Created	Informational	Panther Python

Azure/Azure-Sentinel

4 rules

Detection	Severity	Format
Account created from non-approved sources	Medium	KQL
User Account Created Using Incorrect Naming Format	Low	KQL
User account created without expected attributes defined	Low	KQL
Privileged role assigned to newly created account	Undefined	KQL

SigmaHQ/sigma

3 rules

Detection	Severity	Format
New Federated Domain Added - Exchange	Medium	Sigma
AWS ElastiCache Security Group Created	Low	Sigma
New Github Organization Member Added	Informational	Sigma

chronicle/detection-rules

3 rules

Detection	Severity	Format
gcp_free_gmail_domains_added_to_iam_policy	High	YARA-L
aws_privilege_escalation_using_iam_access_key	Low	YARA-L
aws_privilege_escalation_using_iam_login_profile	Low	YARA-L

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules

Detection	Severity	Format
Cloud Persistence Activities by User At Risk	Undefined	KQL
MITRE ATT&CK Mapping	Undefined	KQL

Wazuh Core Ruleset

1 rule

Detection	Severity	Format
GCP new service account created.	Low	Wazuh XML