{"id":"T1098.003","name":"Additional Cloud Roles","url":"https://attack.mitre.org/techniques/T1098/003","tactics":["persistence","privilege-escalation"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0277","stix_id":"x-mitre-detection-strategy--264a9ce0-b26f-4cc6-bdf4-384b0d188a95","name":"Detection Strategy for Role Addition to Cloud Accounts","url":"https://attack.mitre.org/detectionstrategies/DET0277","analytics":[{"id":"AN0771","stix_id":"x-mitre-analytic--04412d94-62ac-4484-9408-c4ca1c206f1b","name":"Analytic 0771","description":"Detection of new IAM roles or policies attached to a user/service in AWS/GCP/Azure outside normal patterns or hours, often following account compromise.","url":"https://attack.mitre.org/detectionstrategies/DET0277#AN0771","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"AttachUserPolicy, CreatePolicyVersion, PutRolePolicy","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"RoleScope","description":"IAM Role type or privilege level assigned (e.g., Admin, Billing, Viewer)"},{"field":"UserContext","description":"User, service account, or external federated identity context performing the action"},{"field":"PolicyChangeTimeWindow","description":"How quickly multiple roles or policies are added after initial access"},{"field":"ExternalRoleOrigin","description":"Cross-account roles from outside trusted tenant list"}],"live":true,"detection_strategies":["DET0277"],"techniques":["T1098.003"]},{"id":"AN0772","stix_id":"x-mitre-analytic--a52321d0-5961-497b-8212-61602e05420b","name":"Analytic 0772","description":"Behavioral chain of a user being granted elevated privileges or roles in Entra ID or Okta following suspicious login or account creation activity.","url":"https://attack.mitre.org/detectionstrategies/DET0277#AN0772","platforms":["Identity Provider"],"log_source_references":[{"name":"m365:audit","channel":"Add member to role, Add app role assignment","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"m365-audit"}],"mutable_elements":[{"field":"AdminRoleThreshold","description":"Number of accounts allowed to hold sensitive roles like Global Admin"},{"field":"RoleAssignmentMethod","description":"Mechanism by which role was added (PowerShell, API, UI)"},{"field":"GrantContext","description":"Expected user-to-role mapping defined by org policy"}],"live":true,"detection_strategies":["DET0277"],"techniques":["T1098.003"]},{"id":"AN0773","stix_id":"x-mitre-analytic--8601dbfa-8767-4328-8809-1930b53b5e31","name":"Analytic 0773","description":"Detection of new admin or role assignment actions within Microsoft 365/O365 environments to elevate access for persistence or lateral movement.","url":"https://attack.mitre.org/detectionstrategies/DET0277#AN0773","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"Add member to role, Set-Mailbox","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"OfficeRoleType","description":"Admin role type or application role granted"},{"field":"TimeWindow","description":"Time between initial login and privilege change"},{"field":"ActionOrigin","description":"Was the role assignment local or via federated SSO account"}],"live":true,"detection_strategies":["DET0277"],"techniques":["T1098.003"]}],"live":true,"version":"1.0","techniques":["T1098.003"]}],"sigma_rules":[{"id":"22f2fb54-5312-435d-852f-7c74f81684ca","title":"Google Workspace Application Access Level Modified","author":"Bryan Lim","status":"test","level":"medium","date":"2024-01-12","modified":null,"description":"Detects when an access level is changed for a Google workspace application.\nAn access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.\nAn adversary would be able to remove access levels to gain easier access to Google workspace resources.\n","references":["https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings","https://support.google.com/a/answer/9261439"],"logsource":{"product":"gcp","service":"google_workspace.admin"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1098.003"],"path":"rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_application_access_levels_modified.yml","techniques":["T1098.003"],"cves":[]},{"id":"413d4a81-6c98-4479-9863-014785fd579c","title":"Okta Admin Role Assigned to an User or Group","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-09-12","modified":"2026-04-27","description":"Detects when an the Administrator role is assigned to an user or group.","references":["https://developer.okta.com/docs/reference/api/system-log/","https://developer.okta.com/docs/reference/api/event-types/"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1098.003"],"path":"rules/identity/okta/okta_admin_role_assigned_to_user_or_group.yml","techniques":["T1098.003"],"cves":[]},{"id":"5aecf3d5-f8a0-48e7-99be-3a759df7358f","title":"App Granted Privileged Delegated Or App Permissions","author":"Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'","status":"test","level":"high","date":"2022-07-28","modified":"2023-03-29","description":"Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1098.003"],"path":"rules/cloud/azure/audit_logs/azure_app_privileged_permissions.yml","techniques":["T1098.003"],"cves":[]},{"id":"a622fcd2-4b5a-436a-b8a2-a4171161833c","title":"Granting Of Permissions To An Account","author":"sawwinnnaung","status":"test","level":"medium","date":"2020-05-07","modified":"2023-10-11","description":"Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.","references":["https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1098.003"],"path":"rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml","techniques":["T1098.003"],"cves":[]},{"id":"b04934b2-0a68-4845-8a19-bdfed3a68a7a","title":"App Assigned To Azure RBAC/Microsoft Entra Role","author":"Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'","status":"test","level":"medium","date":"2022-07-19","modified":"2024-11-04","description":"Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.","references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1098.003"],"path":"rules/cloud/azure/audit_logs/azure_app_role_added.yml","techniques":["T1098.003"],"cves":[]},{"id":"eaa9ac35-1730-441f-9587-25767bde99d7","title":"Github Outside Collaborator Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2023-01-20","modified":null,"description":"Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.\n","references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"],"logsource":{"product":"github","service":"audit"},"tags":["attack.privilege-escalation","attack.persistence","attack.collection","attack.t1098.001","attack.t1098.003","attack.t1213.003"],"path":"rules/application/github/audit/github_outside_collaborator_detected.yml","techniques":["T1098.001","T1098.003","T1213.003"],"cves":[]},{"id":"ebbeb024-5b1d-4e16-9c0c-917f86c708a7","title":"User Added to an Administrator's Azure AD Role","author":"Raphaël CALVET, @MetallicHack","status":"test","level":"medium","date":"2021-10-04","modified":"2026-04-30","description":"User Added to an Administrator's Azure AD Role","references":["https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/","https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/","https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/","https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory"],"logsource":{"product":"azure","service":"auditlogs"},"tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1098.003","attack.t1078"],"path":"rules/cloud/azure/audit_logs/azure_ad_user_added_to_admin_role.yml","techniques":["T1098.003","T1078"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}