T1666 — Modify Cloud Resource Hierarchy

Tactic: Defense Impairment · Platforms: IaaS

Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses. IaaS environments often group resources into a hierarchy, enabling improved resource management and application of policies to relevant groups. Hierarchical…

Sigma detection rules (1)

T1666 Modify Cloud Resource Hierarchy

title: T1666 Modify Cloud Resource Hierarchy
id: 0158ac14-210e-47f0-a2e7-17a66905baf6
description: 'Detection Strategy for Modify Cloud Resource Hierarchy. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, PrivilegedRoleList, SubscriptionTransferPatterns.'
references:
  - https://attack.mitre.org/techniques/T1666
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1666

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'organizations.amazonaws.com'
    eventName:
      - 'MoveAccount'
      - 'InviteAccountToOrganization'
      - 'LeaveOrganization'
      - 'RemoveAccountFromOrganization'

  condition: selection

falsepositives:
  - Planned account restructuring or merger and acquisition related organizational unit changes performed by cloud governance administrators.

level: high

Explore