T1136.003 — Cloud Account

Tactic: Persistence · Platforms: IaaS, SaaS, Office Suite, Identity Provider

Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. In addition to user accounts,…

Sub-technique of Create Account (T1136).

Sigma detection rules (4)

T1136.003 Create Account: Cloud Account

title: "T1136.003 Create Account: Cloud Account"
id: 1ccb0588-446a-47cc-8ae9-0281b8b6a4bc
description: 'Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: Region, TimeWindow, UserAgent.'
references:
  - https://attack.mitre.org/techniques/T1136/003
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.persistence
  - attack.t1136.003

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_create_user:
    eventSource: 'iam.amazonaws.com'
    eventName: 'CreateUser'
  selection_add_key:
    eventSource: 'iam.amazonaws.com'
    eventName: 'CreateAccessKey'
  selection_add_login:
    eventSource: 'iam.amazonaws.com'
    eventName: 'CreateLoginProfile'

  condition: selection_create_user and (selection_add_key or selection_add_login)

falsepositives:
  - Standard onboarding automation creates a user and its initial credentials in the same workflow, so scope to unexpected callers, unusual regions, or off-hours timing to reduce noise.

level: high

T1136.003 Create Account: Cloud Account

title: "T1136.003 Create Account: Cloud Account"
id: 40a18252-48cf-488a-bb3e-5825dc133f90
description: 'Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office. (Data Component: User Account Creation; baseline tier: fallback.) Tune using: ApplicationScope, AdminUserList.'
references:
  - https://attack.mitre.org/techniques/T1136/003
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.persistence
  - attack.t1136.003

logsource:
  product: saas
  service: zoom

detection:
  selection:
    operation: 'Add'
    category_type: 'User'
    action|contains: 'Added a user'

  condition: selection

falsepositives:
  - Routine provisioning of new employee Zoom accounts through HR-driven automation or standard IT onboarding.

level: medium

T1136.003 Create Account: Cloud Account

title: "T1136.003 Create Account: Cloud Account"
id: 5ac1f742-c250-4674-b823-49a937be7efc
description: 'Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office. (Data Component: User Account Creation; baseline tier: fallback.) Tune using: IPAddress, RoleThreshold, ServicePrincipalFlag.'
references:
  - https://attack.mitre.org/techniques/T1136/003
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.persistence
  - attack.t1136.003

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName:
      - 'Add user'
      - 'Add service principal'

  condition: selection

falsepositives:
  - Routine service principal creation by DevOps pipelines such as Terraform or ARM template deployments.

level: medium

T1136.003 Create Account: Cloud Account

title: "T1136.003 Create Account: Cloud Account"
id: bc0160b9-83e5-48ba-aea5-8517dbd07b61
description: 'Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office. (Data Component: User Account Creation; baseline tier: fallback.) Tune using: GroupSensitivity, GuestFlag.'
references:
  - https://attack.mitre.org/techniques/T1136/003
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.persistence
  - attack.t1136.003

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Add user.'
      - 'Invite external user'

  condition: selection

falsepositives:
  - Legitimate B2B guest invitations issued for external partners or contractors.

level: medium

Related sub-techniques

Explore