Account Manipulation: Additional Cloud Credentials T1098.001

Tactics: Persistence, Privilege Escalation

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Authoring guide

Patterns shared across the 56 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (77 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType17eq 11, in 3, is_not_null 1, starts_with 1, wildcard 1CreateLoginProfile, ADD_APPLICATION, Add, AddRoleToInstanceProfile, Attach
data_stream.dataset17eq 17aws.cloudtrail, azure.auditlogs, azure.signinlogs, azure.activitylogs, gcp.audit
event.outcome13eq 11, in 2success, Success
Provider_Name9eq 9iam.amazonaws.com, admin, rds.amazonaws.com, sts.amazonaws.com
aws::eventName8eq 6, in 2CreateAccessKey, CreateApiKey, AddRoleToDBCluster, AddRoleToDBInstance, AuthorizeDBSecurityGroupIngress
EventID6eq 4, regex_match 3Update application.*Certificates and secrets management, Add application., Add delegated permission grant., Update application., google.iam.admin.v1.CreateServiceAccountKey
aws::errorCode5eq 3, is_not_null 1, is_null 1AccessDenied
event.dataset5eq 5github.audit, aws.cloudtrail
aws::eventSource4eq 4iam.amazonaws.com, rds.amazonaws.com
security_result.action4eq 4ALLOW
type4eq 4admin_api_key_created, admin_api_key_deleted, service_key_created, service_key_revoked
azure_ad::activity_display_name3eq 2, contains 1Add service principal credentials, Update application - Certificates and secrets management, add eligible member to role, add member to role
event.category3eq 3configuration, iam
OperationName2contains 1, eq 1Invite external user, Redeem external user invite, add service principal, certificates and secrets management, update application
action2eq 1, in 1DeleteUserRole, UpdateUserRole, org.remove_outside_collaborator, project.update_user_permission

Top indicator values (161 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.outcomeeq
success
11251
Provider_Nameeq
iam.amazonaws.com
625
data_stream.dataseteq
aws.cloudtrail
6141
data_stream.dataseteq
azure.auditlogs
320
data_stream.dataseteq
azure.signinlogs
230
security_result.actioneq
ALLOW
4102
EventIDregex_match
Update application.*Certificates and secrets management
33
aws::errorCodeeq
AccessDenied
319
aws::eventNameeq
CreateAccessKey
39
aws::eventNameeq
CreateApiKey
22
aws::eventSourceeq
iam.amazonaws.com
328
event.dataseteq
github.audit
314
event.dataseteq
aws.cloudtrail
217
EventTypeeq
CreateLoginProfile
22
event.categoryeq
configuration
211
event.outcomein
Success
237
event.outcomein
success
238
github.programmatic_access_typein
Fine-grained personal access token
26
github.programmatic_access_typein
OAuth access token
26
AADOperationTypein
Assign
16
AADOperationTypein
AssignEligibleRole
15
AppNamestarts_with
ConnectSyncProvisioning_
12
AwsSecurityFindingGeneratorIdeq
security-control/IAM.4
1
Categoryeq
RoleManagement
117
Categoryeq
UserManagement
111
ComplianceSecurityControlIdeq
IAM.4
1
ComplianceStatuseq
FAILED
18
Esql.external_idp_old_issuerne
Esql.external_idp_new_issuer
1
EventIDeq
Add application.
12
EventIDeq
Add delegated permission grant.
1

Exclusions (8 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
aws::errorCodeeq
AccessDenied
1
aws::requestParameterscontains
username=
1
azure.signinlogs.properties.app_owner_tenant_idin
72f988bf-86f1-41af-91ab-2d7cd011db47
1
azure.signinlogs.properties.app_owner_tenant_idin
f8cdef31-a31e-4b4a-93e4-5f571e91255a
1
azure_ad::app_idin
00000003-0000-0ff1-ce00-000000000000
1
azure_ad::app_idin
08e18876-6177-487e-b8b5-cf950c1e598c
1
azure_ad::app_idin
ab9b8c07-8f02-4f72-87fa-80105867a763
1
azure_ad::app_idin
af124e86-4e96-495a-b70a-90f90ab96707
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 8 rules

Elastic 23 rules

Splunk 2 rules

Kusto 5 rules

YARA-L 6 rules

Panther 12 rules