T1098.003 — Additional Cloud Roles

Tactics: Persistence, Privilege Escalation · Platforms: IaaS, Identity Provider, Office Suite, SaaS

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (3)

T1098.003 Account Manipulation: Additional Cloud Roles

title: "T1098.003 Account Manipulation: Additional Cloud Roles"
id: af8a359c-70f5-4af5-8f48-9f3a2d1dbcdd
description: 'Detection Strategy for Role Addition to Cloud Accounts. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RoleScope, UserContext, PolicyChangeTimeWindow, ExternalRoleOrigin.'
references:
  - https://attack.mitre.org/techniques/T1098/003
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.003

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_trust_policy:
    eventSource: 'iam.amazonaws.com'
    eventName: 'UpdateAssumeRolePolicy'
    requestParameters.policyDocument|contains: '"AWS": "arn:aws:iam::'
  selection_role_policy:
    eventSource: 'iam.amazonaws.com'
    eventName:
      - 'PutRolePolicy'
      - 'AttachRolePolicy'
    requestParameters.policyDocument|contains: '"Action": "*"'

  condition: 1 of selection_*

falsepositives:
  - Legitimate infrastructure-as-code deployments periodically update trust policies for new cross-account integrations, so verify the added principal account ID against an approved list before escalating.

level: high

T1098.003 Account Manipulation: Additional Cloud Roles

title: "T1098.003 Account Manipulation: Additional Cloud Roles"
id: 6aa11ebb-6b9d-41b6-b0ac-57c797b54bd3
description: 'Detection Strategy for Role Addition to Cloud Accounts. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: AdminRoleThreshold, RoleAssignmentMethod, GrantContext.'
references:
  - https://attack.mitre.org/techniques/T1098/003
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.003

logsource:
  product: m365
  service: audit

detection:
  selection:
    OperationName: 'Add member to role'
  permanent:
    TargetResources|contains: 'Permanent'

  condition: selection and permanent

falsepositives:
  - Legitimate permanent administrative role grants for designated break glass accounts.

level: high

T1098.003 Account Manipulation: Additional Cloud Roles

title: "T1098.003 Account Manipulation: Additional Cloud Roles"
id: 1e666860-253f-41b3-822d-c8ab9aacfd7c
description: 'Detection Strategy for Role Addition to Cloud Accounts. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: OfficeRoleType, TimeWindow, ActionOrigin.'
references:
  - https://attack.mitre.org/techniques/T1098/003
author: Shahrukh Khan
date: 2026-02-10
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.003

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'Add member to role'
    Workload: 'AzureActiveDirectory'

  condition: selection

falsepositives:
  - Routine administrative role assignments performed during employee onboarding.

level: high

Related sub-techniques

Explore