T1021.007 — Cloud Services

Tactic: Lateral Movement · Platforms: IaaS, Identity Provider, Office Suite, SaaS

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many…

Sub-technique of Remote Services (T1021).

Sigma detection rules (4)

T1021.007 Remote Services: Cloud Services

title: "T1021.007 Remote Services: Cloud Services"
id: a87d5b16-41b6-456e-9d1f-ba132b0d1597
description: 'Behavioral Detection of Remote Cloud Logins via Valid Accounts. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: IPGeoRiskScore, UserAgentFingerprint, SessionDuration, CloudResourceScope.'
references:
  - https://attack.mitre.org/techniques/T1021/007
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.007

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_ssm:
    eventSource: 'ssm.amazonaws.com'
    eventName: 'StartSession'
  selection_instance_connect:
    eventSource: 'ec2-instance-connect.amazonaws.com'
    eventName: 'SendSSHPublicKey'
  selection_run_command:
    eventSource: 'ssm.amazonaws.com'
    eventName: 'SendCommand'
    requestParameters.documentName|contains: 'AWS-RunShellScript'

  condition: 1 of selection_*

falsepositives:
  - Session Manager and EC2 Instance Connect are the standard sanctioned remote access paths in many AWS environments, so tune against normal operator usage patterns and time windows.

level: medium

T1021.007 Remote Services: Cloud Services

title: "T1021.007 Remote Services: Cloud Services"
id: 3d8f8687-3cfb-4671-ae3d-3be77e47016c
description: 'Behavioral Detection of Remote Cloud Logins via Valid Accounts. (Data Component: Logon Session Creation; baseline tier: fallback.) Tune using: OAuthTokenAge, AppScope.'
references:
  - https://attack.mitre.org/techniques/T1021/007
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.007

logsource:
  product: saas
  service: auth

detection:
  selection:
    event_type: 'token_issued'

  condition: selection

falsepositives:
  - Normal OAuth or SAML token refresh cycles for long-lived integrations, CI pipelines, and mobile app sessions reusing the same identity provider.

level: medium

T1021.007 Remote Services: Cloud Services

title: "T1021.007 Remote Services: Cloud Services"
id: d299d045-b6cf-4a42-ac1c-15d1f3a4a919
description: 'Behavioral Detection of Remote Cloud Logins via Valid Accounts. (Data Component: Logon Session Creation; baseline tier: fallback.) Tune using: SSOApplicationScope, ClientIDScope, LoginVelocity.'
references:
  - https://attack.mitre.org/techniques/T1021/007
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.007

logsource:
  product: saas
  service: okta

detection:
  selection:
    eventType: 'user.session.access_admin_app'
    outcome.result: 'SUCCESS'

  condition: selection

falsepositives:
  - Okta administrators legitimately accessing the admin console as part of their normal duties.

level: medium

T1021.007 Remote Services: Cloud Services

title: "T1021.007 Remote Services: Cloud Services"
id: 2a53be43-575e-4b74-a102-ab32abb0e34e
description: 'Behavioral Detection of Remote Cloud Logins via Valid Accounts. (Data Component: File Access; baseline tier: fallback.) Tune using: DevicePlatformMismatch, SensitiveDocumentAccessPattern, AccessFrequencyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1021/007
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.007

logsource:
  product: m365
  service: unified

detection:
  selection_op:
    Operation:
      - 'FileDownloaded'
      - 'FileSyncDownloadedFull'
  selection_susp_agent:
    UserAgent|contains:
      - 'python-requests'
      - 'Go-http-client'
      - 'curl'

  condition: selection_op and selection_susp_agent

falsepositives:
  - Legitimate automation or RPA scripts accessing SharePoint or OneDrive content programmatically.

level: high

Related sub-techniques

Explore