Techniques › T1098 › T1098.003
T1098.003 Additional Cloud Roles
persistence · privilege escalation — IaaS, Identity Provider, Office Suite, SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
7
Sigma rules tagged attack.t1098.003
0
KEV CVEs mapped here
<p>An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).</p><p>This account modification may immediately follow Create Account or other malicious account activity. Adversaries may also modify existing Valid Accounts that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.</p><p>For example, in AWS environments, an adversary with appropriate permissions may be able to use the <code>CreatePolicyVersion</code> API to define a new version of an IAM policy or the <code>AttachUserPolicy</code> API to attach an IAM policy with additional or distinct permissions to a compromised user account.</p><p>In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to Create Account or modify a victim-owned account.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0277 Detection Strategy for Role Addition to Cloud Accounts v1.0
AN0771 IaaSDetection of new IAM roles or policies attached to a user/service in AWS/GCP/Azure outside normal patterns or hours, often following account compromise.AWS:CloudTrail
AttachUserPolicy, CreatePolicyVersion, PutRolePolicy→ DC0010 User Account ModificationTunable:RoleScopeUserContextPolicyChangeTimeWindowExternalRoleOriginAN0772 Identity ProviderBehavioral chain of a user being granted elevated privileges or roles in Entra ID or Okta following suspicious login or account creation activity.Tunable:AdminRoleThresholdRoleAssignmentMethodGrantContextAN0773 Office SuiteDetection of new admin or role assignment actions within Microsoft 365/O365 environments to elevate access for persistence or lateral movement.Tunable:OfficeRoleTypeTimeWindowActionOrigin
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1098.003
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=google_workspace.admin · 22f2fb54-5312-435d-852f-7c74f81684ca
Detects when an access level is changed for a Google workspace application.
An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
An adversary would be able to remove access levels to gain easier access to Google workspace resources.
Author: Austin Songer @austinsonger
· 2021-09-12 (modified 2026-04-27) · logsource: product=okta service=okta · 413d4a81-6c98-4479-9863-014785fd579c
Detects when an the Administrator role is assigned to an user or group.
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
· 2022-07-28 (modified 2023-03-29) · logsource: product=azure service=auditlogs · 5aecf3d5-f8a0-48e7-99be-3a759df7358f
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · a622fcd2-4b5a-436a-b8a2-a4171161833c
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
· 2022-07-19 (modified 2024-11-04) · logsource: product=azure service=auditlogs · b04934b2-0a68-4845-8a19-bdfed3a68a7a
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-20 · logsource: product=github service=audit · eaa9ac35-1730-441f-9587-25767bde99d7
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Author: Raphaël CALVET, @MetallicHack
· 2021-10-04 (modified 2026-04-30) · logsource: product=azure service=auditlogs · ebbeb024-5b1d-4e16-9c0c-917f86c708a7
User Added to an Administrator's Azure AD Role
Rules tagged at the parent level (attack.t1098) 34
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 02122374-b74e-495c-b285-9e4da973f3d6
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Thomas Patzke
· 2019-12-03 (modified 2024-01-16) · logsource: product=windows service=security · 0255a820-e564-4e40-af2b-6ac61160335c
Addition of domains is seldom and should be verified for legitimacy.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · 02c39d30-02b5-45d2-b435-8aebfe5a8629
Detects activity when a member is removed from a security-enabled global group
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 04e2a23a-9b29-4a5c-be3a-3542e3f982ba
Detects when an API access service account is granted domain authority.
Author: toffeebr33k
· 2021-08-09 (modified 2024-04-26) · logsource: product=aws service=cloudtrail · 055fb148-60f8-462d-ad16-26926ce050f1
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Author: faloker
· 2020-02-12 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=process_creation · 0ea8db81-2ff6-4525-9448-33bbe7effc13
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-05 · logsource: product=azure service=auditlogs · 102e11e3-2db5-4c9e-bc26-357d42585d21
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-02-23 · logsource: product=windows category=process_creation · 10fb649c-3600-4d37-b1e6-56ea90bb7e09
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 258b6593-215d-4a26-a141-c8e31c1299a6
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
· 2019-04-03 (modified 2022-08-16) · logsource: product=windows service=security · 2c99737c-585d-4431-b61a-c911d86ff32f
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 2d1b83e4-17c6-4896-a37b-29140b40a788
Detects when an Google Workspace user is granted admin privileges.
Author: @neu5ron
· 2017-04-13 (modified 2024-02-26) · logsource: product=windows service=security · 300bac00-e041-4ee2-9c36-e262656a6ecc
Detects scenarios where one can control another users or computers account without having to use their credentials.
Author: @neu5ron
· 2017-07-30 (modified 2021-12-02) · logsource: product=windows service=security · 311b6ce2-7890-4383-a8c2-663a9f6b43cd
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 32438676-1dba-4ac7-bf69-b86cba995e05
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 3940b5f1-3f46-44aa-b746-ebe615b879e0
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Author: Florian Roth (Nextron Systems)
· 2021-12-22 (modified 2022-12-25) · logsource: product=windows service=security · 45eb2ae2-9aa2-4c3a-99a5-6e5077655466
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: frack113
· 2021-12-28 · logsource: product=windows category=ps_script · 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
Adversaries may manipulate accounts to maintain access to victim systems.
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
Author: Thomas Patzke
· 2017-02-19 (modified 2020-08-23) · logsource: product=windows service=security · 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · 6c9eb492-e477-4df9-b0f4-571fc9db29cd
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.
The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.
If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Daniel Koifman (KoifSec)
· 2025-07-30 · logsource: product=windows category=process_creation · 7864a175-3654-4824-9f0d-f0da18ab27c0
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-04 · logsource: product=linux category=process_creation · 9691f58d-92c1-4416-8bf3-2edd753ec9cf
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 9b111d8e-92e0-4153-88bc-daefc1333aba
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · aac6c4f4-87c7-4961-96ac-c3fd3a42c310
Detects global permissions change activity.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-08-12 (modified 2023-03-02) · logsource: product=windows category=process_creation · ad720b90-25ad-43ff-9b5e-5c841facc8e5
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b056de1a-6e6e-4e40-a67e-97c9808cf41b
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · b237c54b-0f15-4612-a819-44b735e0de27
Detects activity when a security-enabled global group is deleted
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2021-01-17) · logsource: product=windows service=security · c265cf08-3f99-46c1-8d59-328247057d57
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · c43c26be-2e87-46c7-8661-284588c5a53e
Detects activity when a member is added to a security-enabled global group
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · d2d901db-7a75-45a1-bc39-0cbf00812192
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · e15bc294-ae2a-45ad-b7d6-637b33868bde
Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.