LAPSUS$G1004 ↗
Has created global admin accounts in the targeted organization's cloud instances to gain persistence.1
- Tactic
- Persistence
- Platforms
- IaaS, SaaS, Office Suite, Identity Provider
- Version
- 1.6
- Created
- 29 January 2020
- Last modified
- 24 October 2025
- Contributors
- Praetorian; Microsoft Threat Intelligence Center (MSTIC); Arun Seelagan, CISA
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.23
Detection rulesTop 12%
Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.Cloud Account MITRE reference T1136.003
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
Offense vs defense T1136.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 20
first rule: 2021 Q1Cloud Account detection strategy DET0319
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office
4 platforms
AN0899 · Identity Provider
Adversaries create user accounts via identity provider APIs or admin portals (e.g., Azure AD, Okta). These accounts may be assigned elevated privileges or used in chained authentication. Detection monitors Add User activity from suspicious IPs or automation sources, followed by role/permission escalation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | Login from newly created account |
| User Account ModificationDC0010 | azure:audit | Add member to role |
| User Account CreationDC0014 | azure:audit | Add user |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IPAddress | Filter on IPs outside known admin networks or geographies |
| RoleThreshold | Raise alert if total admins exceeds historical baseline |
| ServicePrincipalFlag | Differentiate between user and service principal creation |
AN0900 · IaaS
Adversaries use cloud API, CLI, or console to create IAM users or roles. Initial CreateUser is followed by policy/role attachment. Detection monitors temporal chains involving IAM:CreateUser, AttachUserPolicy, and credential generation, especially from automation or foreign IP ranges.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | AWS:CloudTrail | AttachUserPolicy |
| User Account CreationDC0014 | AWS:CloudTrail | CreateUser |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| Region | Alert when creation happens in unexpected regions |
| TimeWindow | Chain CreateUser → AttachPolicy → AccessKey within short timeframe |
| UserAgent | Monitor API calls from non-console or automation tools |
AN0901 · SaaS
Adversaries create SaaS accounts via admin dashboards or integrations (e.g., Zoom, Salesforce, Slack). Monitor lifecycle.create or account provisioning events from non-standard sources or times.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account CreationDC0014 | saas:zoom | New user created |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApplicationScope | Trigger only for high-privilege or sensitive applications |
| AdminUserList | Compare actor to list of approved SaaS administrators |
AN0902 · Office Suite
Adversaries leverage M365 or Google Workspace APIs to create users, service accounts, or guest accounts. Follow-on behaviors include login activity, role escalation, or service principal token generation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account CreationDC0014 | m365:unified | Add user |
| Group ModificationDC0094 | m365:unified | Add member to group |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GroupSensitivity | Only alert on additions to high-value groups (e.g., Domain Admins) |
| GuestFlag | Tune alerts based on guest vs internal user creation |
Use multi-factor authentication for user and privileged accounts.
Network SegmentationM1030
Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
Limit the number of accounts with permissions to create other accounts. Do not allow privileged accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
Tests3ExecutorsPowerShell 2 · sh 1Need elevation0 of 3Have prerequisites3Have cleanup3Platformsiaas:aws, azure-ad
Tests from Atomic Red Team (MIT licence) · technique definition