Storm-0501G1053 ↗
Has used compromised Entra Connect Sync Server to move laterally within the victim environment.1
- Tactic
- Lateral Movement
- Platforms
- IaaS, Identity Provider, Office Suite, SaaS
- Version
- 1.1
- Created
- 21 February 2023
- Last modified
- 15 April 2025
Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Cloud Services MITRE reference T1021.007
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Scattered SpiderG1015 ↗
Has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.1
APT29G0016 ↗
Has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.1
All 3 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.1
All 1 campaigns for this technique
Offense vs defense T1021.007
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 5
first rule: 2024 Q1 · 1 of 1 campaigns plottedCloud Services detection strategy DET0008
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Remote Cloud Logins via Valid Accounts
4 platforms
AN0017 · IaaS
Cloud login from atypical geolocation or user-agent string, followed by resource enumeration or infrastructure manipulation using cloud CLI/API
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | gcp:audit | None |
| Logon Session CreationDC0067 | AWS:CloudTrail | ConsoleLogin, AssumeRole, ListResources |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IPGeoRiskScore | Tunable scoring system for evaluating geo-divergent or TOR-origin logins |
| UserAgentFingerprint | Flag rare CLI tools or browser-based sessions |
| SessionDuration | Threshold for how long between login and API access |
| CloudResourceScope | Limit monitoring to high-value resource groups or sensitive tenants |
AN0018 · Identity Provider
Federated login using SSO or OAuth grant to cloud control plane, followed by directory or permissions enumeration
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | Okta:SystemLog | user.authentication.sso, app.oauth.grant |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SSOApplicationScope | Tune based on applications federated to high-priv cloud assets |
| ClientIDScope | Filter based on expected OIDC clients used for login |
| LoginVelocity | Track multiple geographic logins within short windows |
AN0019 · Office Suite
Login to M365 or Google Workspace from CLI tools or unexpected source IPs, followed by mailbox or document access
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | m365:unified | FileAccessed, MailboxAccessed |
| Logon Session CreationDC0067 | m365:unified | UserLoggedIn |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DevicePlatformMismatch | Raise alerts on login from CLI when user typically uses web-only |
| SensitiveDocumentAccessPattern | Track access to documents labeled as internal/confidential |
| AccessFrequencyThreshold | Tune for high-volume document reads post login |
AN0020 · SaaS
Remote access to third-party SaaS with OAuth or API tokens post-initial compromise, followed by sensitive data access or configuration changes
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | saas:auth | LoginSuccess, APIKeyUse, AdminAction |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| OAuthTokenAge | Older tokens issued before password change may indicate compromise |
| AppScope | Restrict detection to high-value or regulated SaaS apps |
Use multi-factor authentication on cloud services whenever possible.
Limit the number of high-privileged domain and cloud accounts, and ensure that these are not used for day-to-day operations. Ensure that on-premises accounts do not have privileged cloud permissions and that isolated, cloud-only accounts are used for managing cloud environments.