{"id":"T1136.003","name":"Cloud Account","url":"https://attack.mitre.org/techniques/T1136/003","tactics":["persistence"],"platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0319","stix_id":"x-mitre-detection-strategy--7ad75a00-94f0-4deb-8642-df227a2a8ac6","name":"Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office","url":"https://attack.mitre.org/detectionstrategies/DET0319","analytics":[{"id":"AN0899","stix_id":"x-mitre-analytic--668f1c2b-1a5e-4269-92d9-f7126764dd4e","name":"Analytic 0899","description":"Adversaries create user accounts via identity provider APIs or admin portals (e.g., Azure AD, Okta). These accounts may be assigned elevated privileges or used in chained authentication. Detection monitors Add User activity from suspicious IPs or automation sources, followed by role/permission escalation.","url":"https://attack.mitre.org/detectionstrategies/DET0319#AN0899","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:audit","channel":"Add user","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"azure-audit"},{"name":"azure:audit","channel":"Add member to role","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"azure-audit"},{"name":"azure:signinlogs","channel":"Login from newly created account","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"}],"mutable_elements":[{"field":"IPAddress","description":"Filter on IPs outside known admin networks or geographies"},{"field":"RoleThreshold","description":"Raise alert if total admins exceeds historical baseline"},{"field":"ServicePrincipalFlag","description":"Differentiate between user and service principal creation"}],"live":true,"detection_strategies":["DET0319"],"techniques":["T1136.003"]},{"id":"AN0900","stix_id":"x-mitre-analytic--4264c6fb-20b2-4792-8939-c7d8f204338a","name":"Analytic 0900","description":"Adversaries use cloud API, CLI, or console to create IAM users or roles. Initial CreateUser is followed by policy/role attachment. Detection monitors temporal chains involving IAM:CreateUser, AttachUserPolicy, and credential generation, especially from automation or foreign IP ranges.","url":"https://attack.mitre.org/detectionstrategies/DET0319#AN0900","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"CreateUser","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"AttachUserPolicy","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"Region","description":"Alert when creation happens in unexpected regions"},{"field":"TimeWindow","description":"Chain CreateUser → AttachPolicy → AccessKey within short timeframe"},{"field":"UserAgent","description":"Monitor API calls from non-console or automation tools"}],"live":true,"detection_strategies":["DET0319"],"techniques":["T1136.003"]},{"id":"AN0901","stix_id":"x-mitre-analytic--e619c27e-3d57-489c-8ce9-cbb5f0c195bd","name":"Analytic 0901","description":"Adversaries create SaaS accounts via admin dashboards or integrations (e.g., Zoom, Salesforce, Slack). Monitor lifecycle.create or account provisioning events from non-standard sources or times.","url":"https://attack.mitre.org/detectionstrategies/DET0319#AN0901","platforms":["SaaS"],"log_source_references":[{"name":"saas:zoom","channel":"New user created","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"saas-zoom"}],"mutable_elements":[{"field":"ApplicationScope","description":"Trigger only for high-privilege or sensitive applications"},{"field":"AdminUserList","description":"Compare actor to list of approved SaaS administrators"}],"live":true,"detection_strategies":["DET0319"],"techniques":["T1136.003"]},{"id":"AN0902","stix_id":"x-mitre-analytic--53872bd3-7e5e-4573-ae07-6304bf7e49af","name":"Analytic 0902","description":"Adversaries leverage M365 or Google Workspace APIs to create users, service accounts, or guest accounts. Follow-on behaviors include login activity, role escalation, or service principal token generation.","url":"https://attack.mitre.org/detectionstrategies/DET0319#AN0902","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"Add user","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"m365-unified"},{"name":"m365:unified","channel":"Add member to group","data_component":"DC0094","data_component_name":"Group Modification","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"GroupSensitivity","description":"Only alert on additions to high-value groups (e.g., Domain Admins)"},{"field":"GuestFlag","description":"Tune alerts based on guest vs internal user creation"}],"live":true,"detection_strategies":["DET0319"],"techniques":["T1136.003"]}],"live":true,"version":"1.0","techniques":["T1136.003"]}],"sigma_rules":[{"id":"3908d64a-3c06-4091-b503-b3a94424533b","title":"New Github Organization Member Added","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"informational","date":"2023-01-29","modified":null,"description":"Detects when a new member is added or invited to a github organization.","references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions"],"logsource":{"product":"github","service":"audit"},"tags":["attack.persistence","attack.t1136.003"],"path":"rules/application/github/audit/github_new_org_member.yml","techniques":["T1136.003"],"cves":[]},{"id":"42127bdd-9133-474f-a6f1-97b6c08a4339","title":"New Federated Domain Added - Exchange","author":"Splunk Threat Research Team (original rule), '@ionsor (rule)'","status":"test","level":"medium","date":"2022-02-08","modified":null,"description":"Detects the addition of a new Federated Domain.","references":["https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf","https://us-cert.cisa.gov/ncas/alerts/aa21-008a","https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html","https://www.sygnia.co/golden-saml-advisory","https://o365blog.com/post/aadbackdoor/"],"logsource":{"product":"m365","service":"exchange"},"tags":["attack.persistence","attack.t1136.003"],"path":"rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml","techniques":["T1136.003"],"cves":[]},{"id":"4ae68615-866f-4304-b24b-ba048dfa5ca7","title":"AWS ElastiCache Security Group Created","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Detects when an ElastiCache security group has been created.","references":["https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.persistence","attack.t1136","attack.t1136.003"],"path":"rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml","techniques":["T1136","T1136.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}