ShinyHuntersG1057 ↗
Has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as ListBuckets, CreateBucket and DeleteBucket.1
tfMITRE ATT&CK sub-technique
Cloud API T1059.009
sub-technique of T1059 Command and Scripting Interpreter
- Tactic
- Execution
- Platforms
- IaaS, Identity Provider, Office Suite, SaaS
- Version
- 1.2
- Created
- 17 March 2022
- Last modified
- 12 May 2026
- Contributors
- Ozan Olali; Nichols Jasper; Jason Sevilla; Marcus Weeks; Caio Silva
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell[1], or software developer kits (SDKs) available for languages such as Python.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Cloud API MITRE reference T1059.009
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-0501G1053 ↗
Has leveraged Cloud CLI to execute commands and exfiltrate data from compromised environments.1
TeamTNTG0139 ↗
Has leveraged AWS CLI to enumerate cloud environments with compromised credentials.1
APT29G0016 ↗
Has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API 1
All 4 groups for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TruffleHogS9009 ↗
Has leveraged Cloud CLI in order to enumerate and gather credentials.1
PacuS1091 ↗
Leverages the AWS CLI for its operations.1
All 2 software entries for this technique
Offense vs defense T1059.009
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1
first rule: 2023 Q2Cloud API detection strategy DET0078
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Malicious Cloud API Scripting
1 platform
AN0215 · IaaS
Detects adversarial use of cloud APIs for command execution, resource control, or reconnaissance. Focuses on CLI/SDK/scripting language abuse via stolen credentials or in-browser Cloud Shells. Monitors for anomalous API calls chained with authentication context shifts (e.g., stolen token -> privileged action) and cross-service impacts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | Okta:SystemLog | eventType: user.authentication.sso, app.oauth2.token.grant |
| Command ExecutionDC0064 | AWS:CloudTrail | eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand |
| Cloud Service ModificationDC0069 | azure:activity | operationName: Write, Access Review, RoleAssignment |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Off-hours API usage or configuration changes are more suspicious outside business context. |
| UserAgent | Unexpected SDK usage (e.g., boto3, azcopy, unknown User-Agent strings). |
| CredentialType | High-risk if access token or API key used outside expected geographic/IP behavior. |
| APISequence | Unusual or rapid chaining of provisioning, IAM, and execution APIs. |
| ConsoleContext | Browser-based Cloud Shell vs local CLI may indicate insider vs external use case. |
Execution PreventionM1038
Use application control where appropriate to block use of PowerShell CmdLets or other host based resources to access cloud API resources.
Use of proper Identity and Access Management (IAM) with Role Based Access Control (RBAC) policies to limit actions administrators can perform and provide a history of administrative actions to detect unauthorized use and abuse.