tfMITRE ATT&CK sub-technique

Temporary Elevated Cloud Access T1548.005

sub-technique of T1548 Abuse Elevation Control Mechanism

Tactic: Privilege Escalation
Platforms: IaaS, Office Suite, Identity Provider
Version: 2.0
Created: 10 July 2023
Last modified: 12 May 2026
Contributor: Arad Inbar, Fidelis Security

Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1548.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Temporary Elevated Cloud Access detection strategy DET0393

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Temporary Elevated Cloud Access Abuse (T1548.005)

Enterprise

3 platforms

AN1105 · IaaS

Multiple AWS CloudTrail events indicating temporary privilege escalation via PassRole and AssumeRole targeting newly created services or non-interactive infrastructure.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	PassRole

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
targetRoleName	Define which roles are allowed to be assumed or passed; restrict highly privileged roles.
TimeWindow	Time range between PassRole and AssumeRole events to link the privilege chain.
invokingService	Restrict which services are authorized to invoke role passing (e.g., Lambda, EC2).

AN1106 · Identity Provider

Token creation or access delegation where a user impersonates a higher-privileged service account or performs domain-wide delegation actions, such as GCP's serviceAccountTokenCreator or Workspace impersonation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	gcp:workspaceaudit	Token Generation via Domain Delegation
User Account MetadataDC0013	gcp:iam	PrincipalEmail with serviceAccountTokenCreator impersonating new identity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
userEmailFilter	Tune based on legitimate service accounts allowed to impersonate user accounts.
delegatedScope	Limit delegated access to specific scopes relevant to business functions.

AN1107 · Office Suite

Detection of ApplicationImpersonation role assignment or delegated mailbox access to service principals or rarely used users, especially outside of normal hours or geographic norms.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	m365:signinlogs	Unusual sign-in from service principal to user mailbox
Application Log ContentDC0038	m365:unified	Add-MailboxPermission or Set-ManagementRoleAssignment

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetMailbox	Mailbox of interest where impersonation or access delegation occurs.
UserAgent	Tune based on expected application or script-based mailbox access.
GeoLocation	Restrict based on corporate geography or travel expectations.

Temporary Elevated Cloud Access detections T1548.005

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs