MITRE ATT&CK Technique
Description
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals) In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the <code>CreateKeyPair</code> or <code>ImportKeyPair</code> API in AWS or the <code>gcloud compute os-login ssh-keys add</code> command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) Adversaries may also use the <code>CreateAccessKey</code> API in AWS or the <code>gcloud iam service-accounts keys create</code> command in GCP to add access keys to an account. Alternatively, they may use the <code>CreateLoginProfile</code> API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. (Citation: Crowdstrike AWS User Federation Persistence) In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)
Supported Platforms
Created
April 29, 2026
Last Updated
April 29, 2026
STIX Data
{'created': '2020-01-19T16:10:15.008Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': 'Adversaries may add adversary-controlled credentials to a '
'cloud account to maintain persistent access to victim '
'accounts and instances within the environment.\n'
'\n'
'For example, adversaries may add credentials for Service '
'Principals and Applications in addition to existing '
'legitimate credentials in Azure / Entra ID.(Citation: '
'Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud '
'of Death)(Citation: Blue Cloud of Death Video) These '
'credentials include both x509 keys and passwords.(Citation: '
'Microsoft SolarWinds Customer Guidance) With sufficient '
'permissions, there are a variety of ways to add credentials '
'including the Azure Portal, Azure command line interface, and '
'Azure or Az PowerShell modules.(Citation: Demystifying Azure '
'AD Service Principals)\n'
'\n'
'In infrastructure-as-a-service (IaaS) environments, after '
'gaining access through [Cloud '
'Accounts](https://attack.mitre.org/techniques/T1078/004), '
'adversaries may generate or import their own SSH keys using '
'either the <code>CreateKeyPair</code> or '
'<code>ImportKeyPair</code> API in AWS or the <code>gcloud '
'compute os-login ssh-keys add</code> command in '
'GCP.(Citation: GCP SSH Key Add) This allows persistent access '
'to instances within the cloud environment without further '
'usage of the compromised cloud accounts.(Citation: Expel IO '
'Evil in AWS)(Citation: Expel Behind the Scenes)\n'
'\n'
'Adversaries may also use the <code>CreateAccessKey</code> API '
'in AWS or the <code>gcloud iam service-accounts keys '
'create</code> command in GCP to add access keys to an '
'account. Alternatively, they may use the '
'<code>CreateLoginProfile</code> API in AWS to add a password '
'that can be used to log into the AWS Management Console for '
'[Cloud Service '
'Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: '
'Permiso Scattered Spider 2023)(Citation: Lacework AI Resource '
'Hijacking 2024) If the target account has different '
'permissions from the requesting account, the adversary may '
'also be able to escalate their privileges in the environment '
'(i.e. [Cloud '
'Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: '
'Rhino Security Labs AWS Privilege Escalation)(Citation: '
'Sysdig ScarletEel 2.0) For example, in Entra ID environments, '
'an adversary with the Application Administrator role can add '
"a new set of credentials to their application's service "
'principal. In doing so the adversary would be able to access '
'the service principal’s roles and permissions, which may be '
'different from those of the Application '
'Administrator.(Citation: SpecterOps Azure Privilege '
'Escalation) \n'
'\n'
'In AWS environments, adversaries with the appropriate '
'permissions may also use the `sts:GetFederationToken` API '
'call to create a temporary set of credentials to [Forge Web '
'Credentials](https://attack.mitre.org/techniques/T1606) tied '
'to the permissions of the original user account. These '
'temporary credentials may remain valid for the duration of '
'their lifetime even if the original account’s API credentials '
'are deactivated.\n'
'(Citation: Crowdstrike AWS User Federation Persistence)\n'
'\n'
'In Entra ID environments with the app password feature '
'enabled, adversaries may be able to add an app password to a '
'user account.(Citation: Mandiant APT42 Operations 2024) As '
'app passwords are intended to be used with legacy devices '
'that do not support multi-factor authentication (MFA), adding '
'an app password can allow an adversary to bypass MFA '
'requirements. Additionally, app passwords may remain valid '
'even if the user’s primary password is reset.(Citation: '
'Microsoft Entra ID App Passwords)',
'external_references': [{'external_id': 'T1098.001',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/techniques/T1098/001'},
{'description': ' Vaishnav Murthy and Joel Eng. '
'(2023, January 30). How Adversaries '
'Can Persist with AWS User '
'Federation. Retrieved March 10, '
'2023.',
'source_name': 'Crowdstrike AWS User Federation '
'Persistence',
'url': 'https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/'},
{'description': 'A. Randazzo, B. Manahan and S. '
'Lipton. (2020, April 28). Finding '
'Evil in AWS. Retrieved June 25, '
'2020.',
'source_name': 'Expel IO Evil in AWS',
'url': 'https://expel.io/blog/finding-evil-in-aws/'},
{'description': 'Andy Robbins. (2021, October 12). '
'Azure Privilege Escalation via '
'Service Principal Abuse. Retrieved '
'April 1, 2022.',
'source_name': 'SpecterOps Azure Privilege '
'Escalation',
'url': 'https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5'},
{'description': 'Bellavance, Ned. (2019, July 16). '
'Demystifying Azure AD Service '
'Principals. Retrieved January 19, '
'2020.',
'source_name': 'Demystifying Azure AD Service '
'Principals',
'url': 'https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/'},
{'description': 'Detecting AI resource-hijacking with '
'Composite Alerts. (2024, June 6). '
'Lacework Labs. Retrieved July 1, '
'2024.',
'source_name': 'Lacework AI Resource Hijacking 2024',
'url': 'https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts'},
{'description': 'Google. (n.d.). gcloud compute '
'os-login ssh-keys add. Retrieved '
'October 1, 2020.',
'source_name': 'GCP SSH Key Add',
'url': 'https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add'},
{'description': 'Ian Ahl. (2023, September 20). '
'LUCR-3: SCATTERED SPIDER GETTING '
'SAAS-Y IN THE CLOUD. Retrieved '
'September 25, 2023.',
'source_name': 'Permiso Scattered Spider 2023',
'url': 'https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud'},
{'description': 'Kunz, Bruce. (2018, October 14). '
'Blue Cloud of Death: Red Teaming '
'Azure. Retrieved November 21, 2019.',
'source_name': 'Blue Cloud of Death Video',
'url': 'https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815'},
{'description': 'Kunz, Bryce. (2018, May 11). Blue '
'Cloud of Death: Red Teaming Azure. '
'Retrieved October 23, 2019.',
'source_name': 'Blue Cloud of Death',
'url': 'https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1'},
{'description': 'Microsoft. (2023, October 23). '
'Enforce Microsoft Entra multifactor '
'authentication with legacy '
'applications using app passwords. '
'Retrieved May 28, 2024.',
'source_name': 'Microsoft Entra ID App Passwords',
'url': 'https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords'},
{'description': 'MSRC. (2020, December 13). Customer '
'Guidance on Recent Nation-State '
'Cyber Attacks. Retrieved December '
'17, 2020.',
'source_name': 'Microsoft SolarWinds Customer '
'Guidance',
'url': 'https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/'},
{'description': 'Ofir Rozmann, Asli Koksal, Adrian '
'Hernandez, Sarah Bock, and Jonathan '
'Leathery. (2024, May 1). Uncharmed: '
"Untangling Iran's APT42 Operations. "
'Retrieved May 28, 2024.',
'source_name': 'Mandiant APT42 Operations 2024',
'url': 'https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations'},
{'description': 'S. Lipton, L. Easterly, A. Randazzo '
'and J. Hencinski. (2020, July 28). '
'Behind the scenes in the Expel SOC: '
'Alert-to-fix in AWS. Retrieved '
'October 1, 2020.',
'source_name': 'Expel Behind the Scenes',
'url': 'https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/'},
{'description': 'SCARLETEEL 2.0: Fargate, Kubernetes, '
'and Crypto. (2023, July 11). '
'SCARLETEEL 2.0: Fargate, Kubernetes, '
'and Crypto. Retrieved July 12, 2023.',
'source_name': 'Sysdig ScarletEel 2.0',
'url': 'https://sysdig.com/blog/scarleteel-2-0/'},
{'description': 'Spencer Gietzen. (n.d.). AWS IAM '
'Privilege Escalation – Methods and '
'Mitigation. Retrieved May 27, 2022.',
'source_name': 'Rhino Security Labs AWS Privilege '
'Escalation',
'url': 'https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/'}],
'id': 'attack-pattern--8a2f40cf-8325-47f9-96e4-b1ca4c7389bd',
'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
'phase_name': 'persistence'},
{'kill_chain_name': 'mitre-attack',
'phase_name': 'privilege-escalation'}],
'modified': '2025-10-24T17:49:04.839Z',
'name': 'Additional Cloud Credentials',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'attack-pattern',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Expel',
'Oleg Kolesnikov, Securonix',
'Jannie Li, Microsoft Threat Intelligence\u202f'
'Center\u202f(MSTIC)',
'Zur Ulianitzky, XM Cyber',
'Alex Soler, AttackIQ',
'Dylan Silva, AWS Security',
'Arad Inbar, Fidelis Security',
'Arun Seelagan, CISA'],
'x_mitre_deprecated': False,
'x_mitre_detection': '',
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_is_subtechnique': True,
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_platforms': ['IaaS', 'Identity Provider', 'SaaS'],
'x_mitre_version': '2.8'}