Account Manipulation: Additional Cloud Roles `T1098.003`

Tactics: Persistence, Privilege Escalation

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Authoring guide

Patterns shared across the 107 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (100 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`aws::eventName`	29	`in` 25, `eq` 4	`AttachGroupPolicy`, `AttachRolePolicy`, `AttachUserPolicy`, `PutGroupPolicy`, `PutRolePolicy`
`aws::errorCode`	28	`is_null` 26, `eq` 1, `is_not_null` 1	`AccessDenied`
`data_stream.dataset`	27	`eq` 27	`aws.cloudtrail`, `azure.auditlogs`, `google_workspace.admin`, `o365.audit`, `azure.activitylogs`
`EventType`	26	`eq` 22, `in` 2, `starts_with` 1, `wildcard` 1	`AttachRolePolicy`, `AttachUserPolicy`, `group.privilege.grant`, `org.add_member`, `ASSIGN_ROLE`
`aws::errorMessage`	26	`is_null` 26
`Action`	22	`contains` 22, `starts_with` 12	`dynamodb:create`, `kms:delete`, `cloudformation:`, `cloudformation:create`, `cloudformation:createstack`
`Condition`	22	`eq` 20, `is_null` 2
`Effect`	22	`eq` 22	`Allow`
`Resource`	22	`eq` 22	`*`
`event.outcome`	19	`eq` 16, `in` 3	`success`, `Success`
`sourcetype`	19	`eq` 19	`azure:monitor:aad`, `o365:management:activity`
`Provider_Name`	14	`eq` 13, `in` 1	`iam.amazonaws.com`, `rolesanywhere.amazonaws.com`, `Exchange`, `OneDrive`, `SharePoint`
`operationName`	11	`eq` 9, `starts_with` 2, `contains` 1	`Add member to role`, `Add app role assignment to service principal`, `Add member to role completed (PIM activation)`, `Consent to application`, `MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE`
`EventID`	10	`eq` 10	`Add member to role`, `Add member to role.`, `ASSIGN_ROLE`, `Add member to role outside of PIM (permanent)`, `Add user`
`Operation`	10	`eq` 7, `in` 3	`Add member to role.`, `Update application.`, `Add app role assignment to service principal.`, `Add eligible member to role.`, `Add application.`

Top indicator values (308 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`Effect`	`eq`	`Allow` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	22	27
`Resource`	`eq`	`*` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	22	23
`event.outcome`	`eq`	`success` elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Assume Role Policy Update elasticAWS IAM Login Profile Added to User elasticAWS IAM Roles Anywhere Profile Creation elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS STS AssumeRoot by Rare User and Member Account elasticEntra ID Elevated Access to User Access Administrator elasticGCP IAM Custom Role Creation elasticGCP Storage Bucket Permissions Modification elasticM365 Exchange Management Group Role Assigned elasticM365 Identity Global Administrator Role Assigned elasticM365 SharePoint Site Administrator Added	16	251
`aws::eventName`	`in`	`AttachGroupPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachRolePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachUserPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`CreatePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`CreatePolicyVersion` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`PutGroupPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutRolePolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutUserPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`Action`	`contains`	`iam:passrole` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Action`	`contains`	`kms:delete` kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy	3	3
`Action`	`contains`	`cloudformation:createstack` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy	2	2
`Action`	`starts_with`	`iam:` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD Admin Consent Bypassed by Service Principal splunkAzure AD Application Administrator Role Assigned splunkAzure AD FullAccessAsApp Permission Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD PIM Role Assigned splunkAzure AD PIM Role Assignment Activated splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal splunkAzure AD Service Principal Privilege Escalation splunkAzure AD Tenant Wide Admin Consent Granted	10	47
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Mailbox Read Access Granted to Application splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal Privilege Escalation splunkO365 Tenant Wide Admin Consent Granted	9	80
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Assume Role Policy Update elasticAWS IAM Roles Anywhere Profile Creation elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS STS AssumeRoot by Rare User and Member Account	9	141
`data_stream.dataset`	`eq`	`azure.auditlogs` elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Global Administrator Role Assigned elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified	4	20
`data_stream.dataset`	`eq`	`google_workspace.admin` elasticGoogle Workspace Admin Role Assigned to a User elasticGoogle Workspace Custom Admin Role Created elasticGoogle Workspace User Organizational Unit Changed	3	18
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 Exchange Management Group Role Assigned elasticM365 Identity Global Administrator Role Assigned elasticM365 SharePoint Site Administrator Added	3	45
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Assume Role Policy Update elasticAWS IAM Login Profile Added to User elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell	8	25
`Workload`	`eq`	`AzureActiveDirectory` sigmaUser Added to an Administrator's Azure AD Role splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal	7	31
`security_result.action`	`eq`	`ALLOW` chronicleEntra ID Add User Outside PIM chronicleEntra ID Add User To Admin Role chronicleEntra ID Recently Created User Assigned an Entra ID Role chronicleGCP Admin Privileged Roles Added To Service Accounts chronicleO365 Add User To Admin Role chronicleO365 Recently Created Entra ID User Assigned Roles	6	102
`aws::requestParameters`	`contains`	`policyarn=arn:aws:iam::aws:policy/administratoraccess` elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User	3	3
`event.outcome`	`in`	`Success` elasticAzure Event Hub Authorization Rule Created or Updated elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified	3	37
`event.outcome`	`in`	`success` elasticAzure Event Hub Authorization Rule Created or Updated elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified	3	38
`operationName`	`eq`	`Add member to role` splunkAzure AD Application Administrator Role Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal	3	3
`"{}.RequiredAppPermissions{}.EntitlementId"`	`eq`	`dc890d15-9560-4a4c-9b7f-a736ec74ec40` splunkAzure AD FullAccessAsApp Permission Assigned splunkO365 FullAccessAsApp Permission Assigned	2	2
`"{}.ResourceAppId"`	`eq`	`00000002-0000-0ff1-ce00-000000000000` splunkAzure AD FullAccessAsApp Permission Assigned splunkO365 FullAccessAsApp Permission Assigned	2	2

Exclusions (4 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`aws::requestParameters`	`contains`	`sourcetype=aws_acm_pca` elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA	1
`policyArn`	`contains`	`admin` kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	1
`policyArn`	`contains`	`fullaccess` kustoAWSCloudTrail - Privilege escalation with admin managed policy	1
`policyArn`	`starts_with`	`arn:aws:iam::aws:policy/AdministratorAccess` kustoAWSCloudTrail - Privilege escalation with admin managed policy	1

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Account Manipulation: Additional Cloud Roles `T1098.003`

Authoring guide

Fields filtered most (100 distinct)

Top indicator values (308 distinct)

Exclusions (4 distinct)

Rules under this technique

Sigma 9 rules

Elastic 30 rules

Splunk 19 rules

Kusto 29 rules

YARA-L 9 rules

Panther 11 rules

Keyboard shortcuts

Search operators

Account Manipulation: Additional Cloud Roles T1098.003

Authoring guide

Fields filtered most (100 distinct)

Top indicator values (308 distinct)

Exclusions (4 distinct)

Rules under this technique

Sigma 9 rules

Elastic 30 rules

Splunk 19 rules

Kusto 29 rules

YARA-L 9 rules

Panther 11 rules

Account Manipulation: Additional Cloud Roles `T1098.003`