{"id":"T1098.001","name":"Additional Cloud Credentials","url":"https://attack.mitre.org/techniques/T1098/001","tactics":["persistence","privilege-escalation"],"platforms":["IaaS","Identity Provider","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0531","stix_id":"x-mitre-detection-strategy--cd0c92f4-2345-40ae-aa73-ccc1eb78eb14","name":"Detection Strategy for Additional Cloud Credentials in IaaS/IdP/SaaS","url":"https://attack.mitre.org/detectionstrategies/DET0531","analytics":[{"id":"AN1469","stix_id":"x-mitre-analytic--e95d8309-8435-4c32-9ac3-38e350c170c5","name":"Analytic 1469","description":"Addition of credentials (keys, app passwords, x.509 certs) to existing cloud accounts, service principals, or OAuth apps via portal or API by non-standard identities or IP ranges.","url":"https://attack.mitre.org/detectionstrategies/DET0531#AN1469","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:audit","channel":"Add service principal credentials, app password added, app role assignment","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"azure-audit"}],"mutable_elements":[{"field":"MFABypassMechanism","description":"App password or legacy auth activity bypassing MFA policies."},{"field":"SourceIPAllowlist","description":"Expected IPs allowed to perform admin identity operations."},{"field":"ApplicationCredentialType","description":"Track types like `client_secret`, `certificate`, `password`, `federated`."}],"live":true,"detection_strategies":["DET0531"],"techniques":["T1098.001"]},{"id":"AN1470","stix_id":"x-mitre-analytic--b31afcb5-1690-43f1-acbb-3e2936e48616","name":"Analytic 1470","description":"Cloud API usage to create/import SSH keys or generate new access keys (CreateAccessKey, ImportKeyPair, CreateLoginProfile) from non-console access or unusual principals.","url":"https://attack.mitre.org/detectionstrategies/DET0531#AN1470","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"CreateAccessKey, ImportKeyPair, CreateLoginProfile, CreateKeyPair","data_component":"DC0087","data_component_name":"Active Directory Object Creation","log_source_slug":"aws-cloudtrail"},{"name":"gcp:audit","channel":"iam.serviceAccounts.keys.create, os-login.sshPublicKeys.add","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"gcp-audit"}],"mutable_elements":[{"field":"CallerIdentityContext","description":"Track root, federated identities, and STS tokens separately."},{"field":"NewCredentialUsageWindow","description":"Time between key creation and first use (default: 5 min)."},{"field":"IAMRoleBaseline","description":"Expected services/accounts allowed to create keys."}],"live":true,"detection_strategies":["DET0531"],"techniques":["T1098.001"]},{"id":"AN1471","stix_id":"x-mitre-analytic--7a9088cb-cfe8-4a4a-979c-1ef7678179f2","name":"Analytic 1471","description":"Credential-related configuration changes in productivity apps, such as API key creation in Google Workspace, app tokens in Slack, or user-level OAuth credentials in M365.","url":"https://attack.mitre.org/detectionstrategies/DET0531#AN1471","platforms":["SaaS"],"log_source_references":[{"name":"gcp:audit","channel":"API Key Created, OAuth Client Registered","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"gcp-audit"},{"name":"m365:unified","channel":"Set-Mailbox, Set-AppPassword, Add-MailboxPermission","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"OAuthClientRedirectURIBaseline","description":"Detect suspicious redirect URI mismatches in new clients."},{"field":"TokenScopeSensitivity","description":"Highlight credentials granting excessive read/write org-wide."}],"live":true,"detection_strategies":["DET0531"],"techniques":["T1098.001"]}],"live":true,"version":"1.0","techniques":["T1098.001"]}],"sigma_rules":[{"id":"969c7590-8c19-4797-8c1b-23155de6e7ac","title":"Okta Identity Provider Created","author":"kelnage","status":"test","level":"medium","date":"2023-09-07","modified":"2026-04-27","description":"Detects when a new identity provider is created for Okta.","references":["https://developer.okta.com/docs/reference/api/system-log/","https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1098.001"],"path":"rules/identity/okta/okta_identity_provider_created.yml","techniques":["T1098.001"],"cves":[]},{"id":"cbb67ecc-fb70-4467-9350-c910bdf7c628","title":"Added Credentials to Existing Application","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"high","date":"2022-05-26","modified":"2025-07-18","description":"Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.privilege-escalation","attack.t1098.001","attack.persistence"],"path":"rules/cloud/azure/audit_logs/azure_app_credential_added.yml","techniques":["T1098.001"],"cves":[]},{"id":"eaa9ac35-1730-441f-9587-25767bde99d7","title":"Github Outside Collaborator Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2023-01-20","modified":null,"description":"Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.\n","references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"],"logsource":{"product":"github","service":"audit"},"tags":["attack.privilege-escalation","attack.persistence","attack.collection","attack.t1098.001","attack.t1098.003","attack.t1213.003"],"path":"rules/application/github/audit/github_outside_collaborator_detected.yml","techniques":["T1098.001","T1098.003","T1213.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}