T1098.001 — Additional Cloud Credentials

Tactics: Persistence, Privilege Escalation · Platforms: IaaS, Identity Provider, SaaS

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (3)

title: "T1098.001 Account Manipulation: Additional Cloud Credentials"
id: 1c95e022-d812-4a69-bcfb-90e17125c8e3
description: 'Detection Strategy for Additional Cloud Credentials in IaaS/IdP/SaaS. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CallerIdentityContext, NewCredentialUsageWindow, IAMRoleBaseline.'
references:
  - https://attack.mitre.org/techniques/T1098/001
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_access_key:
    eventSource: 'iam.amazonaws.com'
    eventName: 'CreateAccessKey'
  selection_login_profile:
    eventSource: 'iam.amazonaws.com'
    eventName: 'CreateLoginProfile'

  condition: selection_access_key or selection_login_profile

falsepositives:
  - New employee onboarding legitimately creates access keys and login profiles, so this is high confidence for the technique but should be correlated with whether the caller created credentials for their own account versus another users account.

level: high

title: "T1098.001 Account Manipulation: Additional Cloud Credentials"
id: 799ba7f9-f940-4e88-bd90-ff3bd8397ee4
description: 'Detection Strategy for Additional Cloud Credentials in IaaS/IdP/SaaS. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: OAuthClientRedirectURIBaseline, TokenScopeSensitivity.'
references:
  - https://attack.mitre.org/techniques/T1098/001
author: Shahrukh Khan
date: 2026-06-25
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.001

logsource:
  product: gcp
  service: audit

detection:
  selection:
    protoPayload.methodName: 'google.iam.admin.v1.CreateServiceAccountKey'

  condition: selection

falsepositives:
  - Application deployment pipelines that legitimately provision new service account keys for automation.

level: high

title: "T1098.001 Account Manipulation: Additional Cloud Credentials"
id: cbb3704b-cc2b-4988-80c0-f41678255b4a
description: 'Detection Strategy for Additional Cloud Credentials in IaaS/IdP/SaaS. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: MFABypassMechanism, SourceIPAllowlist, ApplicationCredentialType.'
references:
  - https://attack.mitre.org/techniques/T1098/001
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.001

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName:
      - 'Update application - Certificates and secrets management'
      - 'Add app role assignment to service principal'

  condition: selection

falsepositives:
  - Legitimate application secret rotation or role assignment performed by developers during normal maintenance.

level: high

Related sub-techniques

• T1098.004 SSH Authorized Keys
• T1098.002 Additional Email Delegate Permissions
• T1098.005 Device Registration
• T1098.003 Additional Cloud Roles
• T1098.006 Additional Container Cluster Roles
• T1098.007 Additional Local or Domain Groups

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1098.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan