T1078.004 — Cloud Accounts

Tactics: Stealth, Persistence, Privilege Escalation, Initial Access · Platforms: IaaS, Identity Provider, Office Suite, SaaS

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of…

Sub-technique of Valid Accounts (T1078).

Sigma detection rules (4)

title: "T1078.004 Valid Accounts: Cloud Accounts"
id: ae0973ba-0021-4e3b-8784-86808e7e555d
description: 'Detection of Abused or Compromised Cloud Accounts for Access and Persistence. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServiceInteractionBaseline, RoleSwitchRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1078/004
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'AssumeRole'
  filter_service_source:
    userIdentity.type: 'AWSService'

  condition: selection and not filter_service_source

falsepositives:
  - AssumeRole is the normal mechanism for federated and cross-service access in AWS, so this is only meaningful when correlated with a rate threshold of role switches per identity in a short window.

level: low

title: "T1078.004 Valid Accounts: Cloud Accounts"
id: d9005737-0c56-4154-8fba-e354f45d014b
description: 'Detection of Abused or Compromised Cloud Accounts for Access and Persistence. (Data Component: Logon Session Metadata; baseline tier: fallback.) Tune using: FileDownloadThreshold, SharingPolicyViolationThreshold.'
references:
  - https://attack.mitre.org/techniques/T1078/004
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.004

logsource:
  product: m365
  service: unified

detection:
  selection_share:
    Operation:
      - 'SharingSet'
      - 'AnonymousLinkCreated'
      - 'FileDownloaded'
  selection_cloudonly:
    UserId|contains: '#EXT#'

  condition: selection_share and selection_cloudonly

falsepositives:
  - Guest or federated accounts legitimately collaborating on shared documents with external partners.

level: medium

title: "T1078.004 Valid Accounts: Cloud Accounts"
id: 56e76b4a-43c3-41ed-89ff-226eb950d7c4
description: 'Detection of Abused or Compromised Cloud Accounts for Access and Persistence. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AnomalousLocationThreshold, ProtocolType.'
references:
  - https://attack.mitre.org/techniques/T1078/004
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.004

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
  legacyauth:
    ClientAppUsed:
      - 'IMAP4'
      - 'POP3'
      - 'SMTP'
      - 'Authenticated SMTP'
      - 'Exchange ActiveSync'

  condition: selection and legacyauth

falsepositives:
  - Line-of-business applications or scanners still configured to use legacy authentication protocols.

level: high

title: "T1078.004 Valid Accounts: Cloud Accounts"
id: c584d855-5742-420c-aebc-2bd4686c9eaa
description: 'Detection of Abused or Compromised Cloud Accounts for Access and Persistence. (Data Component: Logon Session Metadata; baseline tier: fallback.) Tune using: BusinessHours, OfficeProductivityToolBaseline.'
references:
  - https://attack.mitre.org/techniques/T1078/004
author: Shahrukh Khan
date: 2026-03-15
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.004

logsource:
  product: m365
  service: signinlogs

detection:
  selection:
    ResultType: '0'
    AuthenticationRequirement: 'singleFactorAuthentication'
  offhours:
    ClientAppUsed: 'Other clients'

  condition: selection and offhours

falsepositives:
  - Legitimate use of legacy or third-party mail clients intentionally configured without modern authentication.

level: medium

Related sub-techniques

• T1078.001 Default Accounts
• T1078.003 Local Accounts
• T1078.002 Domain Accounts

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1078.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan