Valid Accounts: Cloud Accounts

Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory. [1][2][3]

Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a Trusted Relationship. Similar to Domain Accounts, compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.

ID: T1078.004
Sub-technique of:  T1078
Platforms: Azure AD, Google Workspace, IaaS, Office 365, SaaS
Permissions Required: Administrator, User
Contributors: Jon Sternstein, Stern Security
Version: 1.3
Created: 13 March 2020
Last Modified: 18 October 2021
Provided by LAYER 8

Procedure Examples

ID Name Description
G0007 APT28

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.[4]

G0064 APT33

APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.[5]


ID Mitigation Description
M1032 Multi-factor Authentication

Use multi-factor authentication for cloud accounts, especially privileged accounts. This can be implemented in a variety of forms (e.g. hardware, virtual, SMS), and can also be audited using administrative reporting features.[6]

M1027 Password Policies

Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge. Cloud service providers may track access key age to help audit and identify keys that may need to be rotated.[6]

M1026 Privileged Account Management

Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access.[7][8] These reviews should also check if new privileged cloud accounts have been created that were not authorized.

M1018 User Account Management

Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts.

M1017 User Training

Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.


ID Data Source Data Component
DS0028 Logon Session Logon Session Creation
Logon Session Metadata
DS0002 User Account User Account Authentication

Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.