{ "name": "TheCloud.Events — cloud log evidence (AWS + Azure + GCP)", "versions": { "attack": "19", "navigator": "5.1.0", "layer": "4.5" }, "domain": "enterprise-attack", "description": "Techniques scored by how many cloud audit events in the TheCloud.Events catalog (262 AWS + Azure + GCP events) produce log evidence for them. Each technique's links open the event pages with sample logs, analyst notes, and key fields. Generated from https://thecloud.events/.", "sorting": 0, "layout": { "layout": "side", "aggregateFunction": "max", "showID": true, "showName": true, "showAggregateScores": false, "countUnscored": false }, "hideDisabled": false, "techniques": [ { "techniqueID": "T1021", "score": 5, "color": "", "comment": "5 events in the catalog produce evidence for this technique: AWS EnableSerialConsoleAccess, Azure Microsoft.ContainerService/managedClusters/runCommand/action, Azure Microsoft.SerialConsole/serialPorts/connect/action, AWS ResumeSession, AWS StartSession", "enabled": true, "metadata": [], "links": [ { "label": "AWS EnableSerialConsoleAccess", "url": "https://thecloud.events/events/aws-enableserialconsoleaccess/" }, { "label": "Azure Microsoft.ContainerService/managedClusters/runCommand/action", "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-runcommand-action/" }, { "label": "Azure Microsoft.SerialConsole/serialPorts/connect/action", "url": "https://thecloud.events/events/azure-microsoft-serialconsole-serialports-connect-action/" }, { "label": "AWS ResumeSession", "url": "https://thecloud.events/events/aws-resumesession/" }, { "label": "AWS StartSession", "url": "https://thecloud.events/events/aws-startsession/" } ], "showSubtechniques": false }, { "techniqueID": "T1021.004", "score": 10, "color": "", "comment": "10 events in the catalog produce evidence for this technique: GCP Compute.instances.setMetadata, GCP compute.projects.setCommonInstanceMetadata, AWS CreateKeyPair, GCP google.ssh-serialport.v1.connect, AWS ImportKeyPair, Azure Microsoft.Compute/sshPublicKeys/write, AWS SendSerialConsoleSSHPublicKey, AWS SendSSHPublicKey, GCP users.importSshPublicKey, GCP users.sshPublicKeys.patch", "enabled": true, "metadata": [], "links": [ { "label": "GCP Compute.instances.setMetadata", "url": "https://thecloud.events/events/gcp-compute-instances-setmetadata/" }, { "label": "GCP compute.projects.setCommonInstanceMetadata", "url": "https://thecloud.events/events/gcp-compute-projects-setcommoninstancemetadata/" }, { "label": "AWS CreateKeyPair", "url": "https://thecloud.events/events/aws-createkeypair/" }, { "label": "GCP google.ssh-serialport.v1.connect", "url": "https://thecloud.events/events/gcp-google-ssh-serialport-v1-connect/" }, { "label": "AWS ImportKeyPair", "url": "https://thecloud.events/events/aws-importkeypair/" }, { "label": "Azure Microsoft.Compute/sshPublicKeys/write", "url": "https://thecloud.events/events/azure-microsoft-compute-sshpublickeys-write/" }, { "label": "AWS SendSerialConsoleSSHPublicKey", "url": "https://thecloud.events/events/aws-sendserialconsolesshpublickey/" }, { "label": "AWS SendSSHPublicKey", "url": "https://thecloud.events/events/aws-sendsshpublickey/" }, { "label": "GCP users.importSshPublicKey", "url": "https://thecloud.events/events/gcp-users-importsshpublickey/" }, { "label": "GCP users.sshPublicKeys.patch", "url": "https://thecloud.events/events/gcp-users-sshpublickeys-patch/" } ], "showSubtechniques": false }, { "techniqueID": "T1048", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS AuthorizeSecurityGroupEgress", "enabled": true, "metadata": [], "links": [ { "label": "AWS AuthorizeSecurityGroupEgress", "url": "https://thecloud.events/events/aws-authorizesecuritygroupegress/" } ], "showSubtechniques": false }, { "techniqueID": "T1053", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS CreateAssociation", "enabled": true, "metadata": [], "links": [ { "label": "AWS CreateAssociation", "url": "https://thecloud.events/events/aws-createassociation/" } ], "showSubtechniques": false }, { "techniqueID": "T1059", "score": 18, "color": "", "comment": "18 events in the catalog produce evidence for this technique: AWS CreateStack, GCP google.ssh-serialport.v1.connect, AWS Invoke, Azure Microsoft.Automation/automationAccounts/jobs/write, Azure Microsoft.Automation/automationAccounts/runbooks/write, Azure Microsoft.Automation/automationAccounts/webhooks/action, Azure Microsoft.Compute/virtualMachines/extensions/write, Azure Microsoft.Compute/virtualMachines/runCommand/action, Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension), Azure Microsoft.ContainerService/managedClusters/runCommand/action, Azure Microsoft.SerialConsole/serialPorts/connect/action, AWS ModifyInstanceAttribute, AWS ResumeSession, AWS SendCommand, AWS StartBuild, AWS StartSession, AWS UpdateFunctionCode20150331v2, AWS UpdateFunctionConfiguration20150331v2", "enabled": true, "metadata": [], "links": [ { "label": "AWS CreateStack", "url": "https://thecloud.events/events/aws-createstack/" }, { "label": "GCP google.ssh-serialport.v1.connect", "url": "https://thecloud.events/events/gcp-google-ssh-serialport-v1-connect/" }, { "label": "AWS Invoke", "url": "https://thecloud.events/events/aws-invoke/" }, { "label": "Azure Microsoft.Automation/automationAccounts/jobs/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-jobs-write/" }, { "label": "Azure Microsoft.Automation/automationAccounts/runbooks/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-runbooks-write/" }, { "label": "Azure Microsoft.Automation/automationAccounts/webhooks/action", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-action/" }, { "label": "Azure Microsoft.Compute/virtualMachines/extensions/write", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-extensions-write/" }, { "label": "Azure Microsoft.Compute/virtualMachines/runCommand/action", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-runcommand-action/" }, { "label": "Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-write-customscript/" }, { "label": "Azure Microsoft.ContainerService/managedClusters/runCommand/action", "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-runcommand-action/" }, { "label": "Azure Microsoft.SerialConsole/serialPorts/connect/action", "url": "https://thecloud.events/events/azure-microsoft-serialconsole-serialports-connect-action/" }, { "label": "AWS ModifyInstanceAttribute", "url": "https://thecloud.events/events/aws-modifyinstanceattribute/" }, { "label": "AWS ResumeSession", "url": "https://thecloud.events/events/aws-resumesession/" }, { "label": "AWS SendCommand", "url": "https://thecloud.events/events/aws-sendcommand/" }, { "label": "AWS StartBuild", "url": "https://thecloud.events/events/aws-startbuild/" }, { "label": "AWS StartSession", "url": "https://thecloud.events/events/aws-startsession/" }, { "label": "AWS UpdateFunctionCode20150331v2", "url": "https://thecloud.events/events/aws-updatefunctioncode20150331v2/" }, { "label": "AWS UpdateFunctionConfiguration20150331v2", "url": "https://thecloud.events/events/aws-updatefunctionconfiguration20150331v2/" } ], "showSubtechniques": false }, { "techniqueID": "T1070", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: GCP google.iam.admin.v1.DeleteServiceAccountKey", "enabled": true, "metadata": [], "links": [ { "label": "GCP google.iam.admin.v1.DeleteServiceAccountKey", "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-deleteserviceaccountkey/" } ], "showSubtechniques": false }, { "techniqueID": "T1072", "score": 5, "color": "", "comment": "5 events in the catalog produce evidence for this technique: AWS CreateStack, Azure Microsoft.Automation/automationAccounts/jobs/write, Azure Microsoft.Automation/automationAccounts/runbooks/write, Azure Microsoft.Automation/automationAccounts/webhooks/action, Azure Microsoft.Automation/automationAccounts/webhooks/write", "enabled": true, "metadata": [], "links": [ { "label": "AWS CreateStack", "url": "https://thecloud.events/events/aws-createstack/" }, { "label": "Azure Microsoft.Automation/automationAccounts/jobs/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-jobs-write/" }, { "label": "Azure Microsoft.Automation/automationAccounts/runbooks/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-runbooks-write/" }, { "label": "Azure Microsoft.Automation/automationAccounts/webhooks/action", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-action/" }, { "label": "Azure Microsoft.Automation/automationAccounts/webhooks/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-write/" } ], "showSubtechniques": false }, { "techniqueID": "T1078.004", "score": 14, "color": "", "comment": "14 events in the catalog produce evidence for this technique: AWS AddRoleToInstanceProfile, AWS AssumeRole, AWS AssumeRoleWithSAML, AWS AssumeRoleWithWebIdentity, AWS ConsoleLogin, GCP generateAccessToken, AWS GetFederationToken, AWS GetSessionToken, GCP iam.serviceAccounts.actAs, GCP iam.serviceAccounts.implicitDelegation, GCP iam.serviceAccounts.signJwt, Azure Microsoft.Authorization/elevateAccess/action, AWS PassRole, AWS PasswordRecoveryRequested", "enabled": true, "metadata": [], "links": [ { "label": "AWS AddRoleToInstanceProfile", "url": "https://thecloud.events/events/aws-addroletoinstanceprofile/" }, { "label": "AWS AssumeRole", "url": "https://thecloud.events/events/aws-assumerole/" }, { "label": "AWS AssumeRoleWithSAML", "url": "https://thecloud.events/events/aws-assumerolewithsaml/" }, { "label": "AWS AssumeRoleWithWebIdentity", "url": "https://thecloud.events/events/aws-assumerolewithwebidentity/" }, { "label": "AWS ConsoleLogin", "url": "https://thecloud.events/events/aws-consolelogin/" }, { "label": "GCP generateAccessToken", "url": "https://thecloud.events/events/gcp-generateaccesstoken/" }, { "label": "AWS GetFederationToken", "url": "https://thecloud.events/events/aws-getfederationtoken/" }, { "label": "AWS GetSessionToken", "url": "https://thecloud.events/events/aws-getsessiontoken/" }, { "label": "GCP iam.serviceAccounts.actAs", "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-actas/" }, { "label": "GCP iam.serviceAccounts.implicitDelegation", "url": "https://thecloud.events/events/gcp-iam-serviceaccountkeys-implicitdelegation/" }, { "label": "GCP iam.serviceAccounts.signJwt", "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-signjwt/" }, { "label": "Azure Microsoft.Authorization/elevateAccess/action", "url": "https://thecloud.events/events/azure-microsoft-authorization-elevateaccess-action/" }, { "label": "AWS PassRole", "url": "https://thecloud.events/events/aws-passrole/" }, { "label": "AWS PasswordRecoveryRequested", "url": "https://thecloud.events/events/aws-passwordrecoveryrequested/" } ], "showSubtechniques": false }, { "techniqueID": "T1098", "score": 40, "color": "", "comment": "40 events in the catalog produce evidence for this technique: Azure Add Owner To Application, Azure Add Owner To Group, Azure Add User, AWS AddPermission20150331v2, AWS AddUserToGroup, Azure Admin Registered Security Info, AWS AssociateIamInstanceProfile, AWS AttachGroupPolicy, AWS AttachRolePolicy, AWS AttachUserPolicy, AWS ChangePassword, GCP compute.disks.setIamPolicy, GCP compute.instances.setServiceAccount, Azure Consent To Application, AWS CreateAccessEntry, AWS CreateDevEndpoint, AWS CreatePolicy, AWS CreatePolicyVersion, GCP CreateRole, AWS CreateStack, AWS CreateUser, AWS CreateVirtualMFADevice, GCP EnableServiceAccount, GCP google.iam.admin.v1.SetIamPolicy, GCP iam.roles.update, Azure Microsoft.KeyVault/vaults/accessPolicies/write, Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action, AWS PutGroupPolicy, AWS PutKeyPolicy, AWS PutRolePolicy, AWS PutUserPolicy, AWS ReplaceIamInstanceProfileAssociation, Azure Reset User Password, AWS SetDefaultPolicyVersion, Azure Update User Authentication Methods, AWS UpdateAccessKey, AWS UpdateAssumeRolePolicy, AWS UpdateDevEndpoint, AWS UpdateFunctionConfiguration20150331v2, AWS UpdateLoginProfile", "enabled": true, "metadata": [], "links": [ { "label": "Azure Add Owner To Application", "url": "https://thecloud.events/events/azure-add-owner-to-application/" }, { "label": "Azure Add Owner To Group", "url": "https://thecloud.events/events/azure-add-owner-to-group/" }, { "label": "Azure Add User", "url": "https://thecloud.events/events/azure-add-user/" }, { "label": "AWS AddPermission20150331v2", "url": "https://thecloud.events/events/aws-addpermission20150331v2/" }, { "label": "AWS AddUserToGroup", "url": "https://thecloud.events/events/aws-addusertogroup/" }, { "label": "Azure Admin Registered Security Info", "url": "https://thecloud.events/events/azure-admin-registered-security-info/" }, { "label": "AWS AssociateIamInstanceProfile", "url": "https://thecloud.events/events/aws-associateiaminstanceprofile/" }, { "label": "AWS AttachGroupPolicy", "url": "https://thecloud.events/events/aws-attachgrouppolicy/" }, { "label": "AWS AttachRolePolicy", "url": "https://thecloud.events/events/aws-attachrolepolicy/" }, { "label": "AWS AttachUserPolicy", "url": "https://thecloud.events/events/aws-attachuserpolicy/" }, { "label": "AWS ChangePassword", "url": "https://thecloud.events/events/aws-changepassword/" }, { "label": "GCP compute.disks.setIamPolicy", "url": "https://thecloud.events/events/gcp-compute-disks-setiampolicy/" }, { "label": "GCP compute.instances.setServiceAccount", "url": "https://thecloud.events/events/gcp-compute-instances-setserviceaccount/" }, { "label": "Azure Consent To Application", "url": "https://thecloud.events/events/azure-consent-to-application/" }, { "label": "AWS CreateAccessEntry", "url": "https://thecloud.events/events/aws-createaccessentry/" }, { "label": "AWS CreateDevEndpoint", "url": "https://thecloud.events/events/aws-createdevendpoint/" }, { "label": "AWS CreatePolicy", "url": "https://thecloud.events/events/aws-createpolicy/" }, { "label": "AWS CreatePolicyVersion", "url": "https://thecloud.events/events/aws-createpolicyversion/" }, { "label": "GCP CreateRole", "url": "https://thecloud.events/events/gcp-createrole/" }, { "label": "AWS CreateStack", "url": "https://thecloud.events/events/aws-createstack/" }, { "label": "AWS CreateUser", "url": "https://thecloud.events/events/aws-createuser/" }, { "label": "AWS CreateVirtualMFADevice", "url": "https://thecloud.events/events/aws-createvirtualmfadevice/" }, { "label": "GCP EnableServiceAccount", "url": "https://thecloud.events/events/gcp-enableserviceaccount/" }, { "label": "GCP google.iam.admin.v1.SetIamPolicy", "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-setiampolicy-or-setiampolicy/" }, { "label": "GCP iam.roles.update", "url": "https://thecloud.events/events/gcp-iam-roles-update/" }, { "label": "Azure Microsoft.KeyVault/vaults/accessPolicies/write", "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-accesspolicies-write/" }, { "label": "Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action", "url": "https://thecloud.events/events/azure-microsoft-managedidentity-userassignedidentities-assign-action/" }, { "label": "AWS PutGroupPolicy", "url": "https://thecloud.events/events/aws-putgrouppolicy/" }, { "label": "AWS PutKeyPolicy", "url": "https://thecloud.events/events/aws-putkeypolicy/" }, { "label": "AWS PutRolePolicy", "url": "https://thecloud.events/events/aws-putrolepolicy/" }, { "label": "AWS PutUserPolicy", "url": "https://thecloud.events/events/aws-putuserpolicy/" }, { "label": "AWS ReplaceIamInstanceProfileAssociation", "url": "https://thecloud.events/events/aws-replaceiaminstanceprofileassociation/" }, { "label": "Azure Reset User Password", "url": "https://thecloud.events/events/azure-reset-user-password/" }, { "label": "AWS SetDefaultPolicyVersion", "url": "https://thecloud.events/events/aws-setdefaultpolicyversion/" }, { "label": "Azure Update User Authentication Methods", "url": "https://thecloud.events/events/azure-update-user-authentication-methods/" }, { "label": "AWS UpdateAccessKey", "url": "https://thecloud.events/events/aws-updateaccesskey/" }, { "label": "AWS UpdateAssumeRolePolicy", "url": "https://thecloud.events/events/aws-updateassumerolepolicy/" }, { "label": "AWS UpdateDevEndpoint", "url": "https://thecloud.events/events/aws-updatedevendpoint/" }, { "label": "AWS UpdateFunctionConfiguration20150331v2", "url": "https://thecloud.events/events/aws-updatefunctionconfiguration20150331v2/" }, { "label": "AWS UpdateLoginProfile", "url": "https://thecloud.events/events/aws-updateloginprofile/" } ], "showSubtechniques": false }, { "techniqueID": "T1098.001", "score": 7, "color": "", "comment": "7 events in the catalog produce evidence for this technique: Azure Add Federated Identity Credential, AWS CreateAccessKey, AWS CreateLoginProfile, GCP google.iam.admin.v1.CreateServiceAccountKey, GCP google.iam.admin.v1.UploadServiceAccountKey, Azure Microsoft.Directory/servicePrincipals/credentials/update, GCP storage.hmacKeys.create", "enabled": true, "metadata": [], "links": [ { "label": "Azure Add Federated Identity Credential", "url": "https://thecloud.events/events/azure-add-federated-identity-credential/" }, { "label": "AWS CreateAccessKey", "url": "https://thecloud.events/events/aws-createaccesskey/" }, { "label": "AWS CreateLoginProfile", "url": "https://thecloud.events/events/aws-createloginprofile/" }, { "label": "GCP google.iam.admin.v1.CreateServiceAccountKey", "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-createserviceaccountkey/" }, { "label": "GCP google.iam.admin.v1.UploadServiceAccountKey", "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-uploadserviceaccountkey/" }, { "label": "Azure Microsoft.Directory/servicePrincipals/credentials/update", "url": "https://thecloud.events/events/azure-microsoft-directory-serviceprincipals-credentials-update/" }, { "label": "GCP storage.hmacKeys.create", "url": "https://thecloud.events/events/gcp-storage-hmackeys-create/" } ], "showSubtechniques": false }, { "techniqueID": "T1098.003", "score": 11, "color": "", "comment": "11 events in the catalog produce evidence for this technique: Azure Add App Role Assignment To Service Principal, Azure Add Eligible Member To Role In Pim Completed, Azure Add Member To Role, Azure Add Role Definition, GCP add-iam-policy-binding, AWS CreateRole, AWS CreateServiceLinkedRole, Azure Microsoft.Authorization/roleAssignments/write, Azure Microsoft.Directory/groups/members/update, GCP storage.setIamPermissions, Azure Update Role Definition", "enabled": true, "metadata": [], "links": [ { "label": "Azure Add App Role Assignment To Service Principal", "url": "https://thecloud.events/events/azure-add-app-role-assignment-to-service-principal/" }, { "label": "Azure Add Eligible Member To Role In Pim Completed", "url": "https://thecloud.events/events/azure-add-eligible-member-to-role-in-pim-completed/" }, { "label": "Azure Add Member To Role", "url": "https://thecloud.events/events/azure-add-member-to-role/" }, { "label": "Azure Add Role Definition", "url": "https://thecloud.events/events/azure-add-role-definition/" }, { "label": "GCP add-iam-policy-binding", "url": "https://thecloud.events/events/gcp-add-iam-policy-binding/" }, { "label": "AWS CreateRole", "url": "https://thecloud.events/events/aws-createrole/" }, { "label": "AWS CreateServiceLinkedRole", "url": "https://thecloud.events/events/aws-createservicelinkedrole/" }, { "label": "Azure Microsoft.Authorization/roleAssignments/write", "url": "https://thecloud.events/events/azure-microsoft-authorization-roleassignments-write/" }, { "label": "Azure Microsoft.Directory/groups/members/update", "url": "https://thecloud.events/events/azure-microsoft-directory-groups-members-update/" }, { "label": "GCP storage.setIamPermissions", "url": "https://thecloud.events/events/gcp-storage-setiampermissions/" }, { "label": "Azure Update Role Definition", "url": "https://thecloud.events/events/azure-update-role-definition/" } ], "showSubtechniques": false }, { "techniqueID": "T1098.004", "score": 9, "color": "", "comment": "9 events in the catalog produce evidence for this technique: GCP Compute.instances.setMetadata, GCP compute.projects.setCommonInstanceMetadata, AWS CreateKeyPair, AWS ImportKeyPair, Azure Microsoft.Compute/sshPublicKeys/write, AWS SendSerialConsoleSSHPublicKey, AWS SendSSHPublicKey, GCP users.importSshPublicKey, GCP users.sshPublicKeys.patch", "enabled": true, "metadata": [], "links": [ { "label": "GCP Compute.instances.setMetadata", "url": "https://thecloud.events/events/gcp-compute-instances-setmetadata/" }, { "label": "GCP compute.projects.setCommonInstanceMetadata", "url": "https://thecloud.events/events/gcp-compute-projects-setcommoninstancemetadata/" }, { "label": "AWS CreateKeyPair", "url": "https://thecloud.events/events/aws-createkeypair/" }, { "label": "AWS ImportKeyPair", "url": "https://thecloud.events/events/aws-importkeypair/" }, { "label": "Azure Microsoft.Compute/sshPublicKeys/write", "url": "https://thecloud.events/events/azure-microsoft-compute-sshpublickeys-write/" }, { "label": "AWS SendSerialConsoleSSHPublicKey", "url": "https://thecloud.events/events/aws-sendserialconsolesshpublickey/" }, { "label": "AWS SendSSHPublicKey", "url": "https://thecloud.events/events/aws-sendsshpublickey/" }, { "label": "GCP users.importSshPublicKey", "url": "https://thecloud.events/events/gcp-users-importsshpublickey/" }, { "label": "GCP users.sshPublicKeys.patch", "url": "https://thecloud.events/events/gcp-users-sshpublickeys-patch/" } ], "showSubtechniques": false }, { "techniqueID": "T1133", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: GCP compute.instances.addAccessConfig", "enabled": true, "metadata": [], "links": [ { "label": "GCP compute.instances.addAccessConfig", "url": "https://thecloud.events/events/gcp-compute-instances-addaccessconfig/" } ], "showSubtechniques": false }, { "techniqueID": "T1136.003", "score": 6, "color": "", "comment": "6 events in the catalog produce evidence for this technique: Azure Add Application, Azure Add Service Principal, Azure Add User, AWS CreateAccount, AWS CreateUser, Azure Invite External User", "enabled": true, "metadata": [], "links": [ { "label": "Azure Add Application", "url": "https://thecloud.events/events/azure-add-application/" }, { "label": "Azure Add Service Principal", "url": "https://thecloud.events/events/azure-add-service-principal/" }, { "label": "Azure Add User", "url": "https://thecloud.events/events/azure-add-user/" }, { "label": "AWS CreateAccount", "url": "https://thecloud.events/events/aws-createaccount/" }, { "label": "AWS CreateUser", "url": "https://thecloud.events/events/aws-createuser/" }, { "label": "Azure Invite External User", "url": "https://thecloud.events/events/azure-invite-external-user/" } ], "showSubtechniques": false }, { "techniqueID": "T1213.006", "score": 3, "color": "", "comment": "3 events in the catalog produce evidence for this technique: GCP bigquery.jobs.insert, GCP cloudsql.instances.export, AWS ModifyDBInstance", "enabled": true, "metadata": [], "links": [ { "label": "GCP bigquery.jobs.insert", "url": "https://thecloud.events/events/gcp-bigquery-jobs-insert/" }, { "label": "GCP cloudsql.instances.export", "url": "https://thecloud.events/events/gcp-cloudsql-instances-export/" }, { "label": "AWS ModifyDBInstance", "url": "https://thecloud.events/events/aws-modifydbinstance/" } ], "showSubtechniques": false }, { "techniqueID": "T1484.002", "score": 4, "color": "", "comment": "4 events in the catalog produce evidence for this technique: Azure Add Verified Domain, AWS CreateOpenIDConnectProvider, AWS CreateSAMLProvider, AWS UpdateAssumeRolePolicy", "enabled": true, "metadata": [], "links": [ { "label": "Azure Add Verified Domain", "url": "https://thecloud.events/events/azure-add-verified-domain/" }, { "label": "AWS CreateOpenIDConnectProvider", "url": "https://thecloud.events/events/aws-createopenidconnectprovider/" }, { "label": "AWS CreateSAMLProvider", "url": "https://thecloud.events/events/aws-createsamlprovider/" }, { "label": "AWS UpdateAssumeRolePolicy", "url": "https://thecloud.events/events/aws-updateassumerolepolicy/" } ], "showSubtechniques": false }, { "techniqueID": "T1485", "score": 27, "color": "", "comment": "27 events in the catalog produce evidence for this technique: AWS DeleteBucket, AWS DeleteDBCluster, AWS DeleteDBInstance, AWS DeleteFileSystem, AWS DeleteGlobalCluster, AWS DeleteObject, AWS DeleteObjects, AWS DeleteSnapshot, AWS DeleteVolume, Azure Microsoft.Authorization/locks/delete, Azure Microsoft.Compute/virtualMachines/delete, Azure Microsoft.EventHub/namespaces/eventhubs/delete, Azure Microsoft.KeyVault/vaults/delete, Azure Microsoft.KeyVault/vaults/secrets/delete, Azure Microsoft.OperationalInsights/workspaces/delete, Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete, Azure Microsoft.Sql/servers/databases/delete, Azure Microsoft.Storage/storageAccounts/blobServices/containers/delete, Azure Microsoft.Storage/storageAccounts/delete, AWS PutBucketLifecycle, AWS PutBucketLifecycleConfiguration, AWS ScheduleKeyDeletion, GCP secretmanager.secrets.delete, GCP SecretManagerService.DestroySecretVersion, GCP storage.buckets.delete, GCP storage.objects.delete, AWS TerminateInstances", "enabled": true, "metadata": [], "links": [ { "label": "AWS DeleteBucket", "url": "https://thecloud.events/events/aws-deletebucket/" }, { "label": "AWS DeleteDBCluster", "url": "https://thecloud.events/events/aws-deletedbcluster/" }, { "label": "AWS DeleteDBInstance", "url": "https://thecloud.events/events/aws-deletedbinstance/" }, { "label": "AWS DeleteFileSystem", "url": "https://thecloud.events/events/aws-deletefilesystem/" }, { "label": "AWS DeleteGlobalCluster", "url": "https://thecloud.events/events/aws-deleteglobalcluster/" }, { "label": "AWS DeleteObject", "url": "https://thecloud.events/events/aws-deleteobject/" }, { "label": "AWS DeleteObjects", "url": "https://thecloud.events/events/aws-deleteobjects/" }, { "label": "AWS DeleteSnapshot", "url": "https://thecloud.events/events/aws-deletesnapshot/" }, { "label": "AWS DeleteVolume", "url": "https://thecloud.events/events/aws-deletevolume/" }, { "label": "Azure Microsoft.Authorization/locks/delete", "url": "https://thecloud.events/events/azure-microsoft-authorization-locks-delete/" }, { "label": "Azure Microsoft.Compute/virtualMachines/delete", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-delete/" }, { "label": "Azure Microsoft.EventHub/namespaces/eventhubs/delete", "url": "https://thecloud.events/events/azure-microsoft-eventhub-namespaces-eventhubs-delete/" }, { "label": "Azure Microsoft.KeyVault/vaults/delete", "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-delete/" }, { "label": "Azure Microsoft.KeyVault/vaults/secrets/delete", "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-secrets-delete/" }, { "label": "Azure Microsoft.OperationalInsights/workspaces/delete", "url": "https://thecloud.events/events/azure-microsoft-operationalinsights-workspaces-delete/" }, { "label": "Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete", "url": "https://thecloud.events/events/azure-microsoft-recoveryservices-vaults-backupprotecteditems-delete/" }, { "label": "Azure Microsoft.Sql/servers/databases/delete", "url": "https://thecloud.events/events/azure-microsoft-sql-servers-databases-delete/" }, { "label": "Azure Microsoft.Storage/storageAccounts/blobServices/containers/delete", "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-blobservices-containers-delete/" }, { "label": "Azure Microsoft.Storage/storageAccounts/delete", "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-delete/" }, { "label": "AWS PutBucketLifecycle", "url": "https://thecloud.events/events/aws-putbucketlifecycle/" }, { "label": "AWS PutBucketLifecycleConfiguration", "url": "https://thecloud.events/events/aws-putbucketlifecycleconfiguration/" }, { "label": "AWS ScheduleKeyDeletion", "url": "https://thecloud.events/events/aws-schedulekeydeletion/" }, { "label": "GCP secretmanager.secrets.delete", "url": "https://thecloud.events/events/gcp-secretmanager-secrets-delete/" }, { "label": "GCP SecretManagerService.DestroySecretVersion", "url": "https://thecloud.events/events/gcp-secretmanagerservice-destroysecretversion/" }, { "label": "GCP storage.buckets.delete", "url": "https://thecloud.events/events/gcp-storage-buckets-delete/" }, { "label": "GCP storage.objects.delete", "url": "https://thecloud.events/events/gcp-storage-objects-delete/" }, { "label": "AWS TerminateInstances", "url": "https://thecloud.events/events/aws-terminateinstances/" } ], "showSubtechniques": false }, { "techniqueID": "T1489", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS DisableKey", "enabled": true, "metadata": [], "links": [ { "label": "AWS DisableKey", "url": "https://thecloud.events/events/aws-disablekey/" } ], "showSubtechniques": false }, { "techniqueID": "T1490", "score": 2, "color": "", "comment": "2 events in the catalog produce evidence for this technique: Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete, AWS PutBucketLifecycle", "enabled": true, "metadata": [], "links": [ { "label": "Azure Microsoft.RecoveryServices/vaults/backupProtectedItems/delete", "url": "https://thecloud.events/events/azure-microsoft-recoveryservices-vaults-backupprotecteditems-delete/" }, { "label": "AWS PutBucketLifecycle", "url": "https://thecloud.events/events/aws-putbucketlifecycle/" } ], "showSubtechniques": false }, { "techniqueID": "T1525", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS PutImage", "enabled": true, "metadata": [], "links": [ { "label": "AWS PutImage", "url": "https://thecloud.events/events/aws-putimage/" } ], "showSubtechniques": false }, { "techniqueID": "T1526", "score": 3, "color": "", "comment": "3 events in the catalog produce evidence for this technique: AWS GetParameters, AWS GetSecretValue, Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action", "enabled": true, "metadata": [], "links": [ { "label": "AWS GetParameters", "url": "https://thecloud.events/events/aws-getparameters/" }, { "label": "AWS GetSecretValue", "url": "https://thecloud.events/events/aws-getsecretvalue/" }, { "label": "Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action", "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-listclusteradmincredential-action/" } ], "showSubtechniques": false }, { "techniqueID": "T1528", "score": 6, "color": "", "comment": "6 events in the catalog produce evidence for this technique: Azure Consent To Application, GCP generateAccessToken, AWS GetFederationToken, AWS GetSessionToken, AWS GetSigninToken, GCP iam.serviceAccounts.signJwt", "enabled": true, "metadata": [], "links": [ { "label": "Azure Consent To Application", "url": "https://thecloud.events/events/azure-consent-to-application/" }, { "label": "GCP generateAccessToken", "url": "https://thecloud.events/events/gcp-generateaccesstoken/" }, { "label": "AWS GetFederationToken", "url": "https://thecloud.events/events/aws-getfederationtoken/" }, { "label": "AWS GetSessionToken", "url": "https://thecloud.events/events/aws-getsessiontoken/" }, { "label": "AWS GetSigninToken", "url": "https://thecloud.events/events/aws-getsignintoken/" }, { "label": "GCP iam.serviceAccounts.signJwt", "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-signjwt/" } ], "showSubtechniques": false }, { "techniqueID": "T1530", "score": 22, "color": "", "comment": "22 events in the catalog produce evidence for this technique: Azure CopyBlob, AWS CopyObject, AWS CreateDBSnapshot, AWS CreateImage, AWS CreateInstanceExportTask, AWS CreateSnapshot, AWS DeleteBucketPolicy, AWS GetObject, Azure Microsoft.Compute/disks/beginGetAccess/action, Azure Microsoft.Compute/snapshots/beginGetAccess/action, Azure Microsoft.Sql/servers/databases/export/action, AWS ModifyDBSnapshotAttribute, AWS ModifyImageAttribute, AWS ModifySnapshotAttribute, AWS PutBucketAcl, AWS PutBucketPolicy, AWS PutBucketPublicAccessBlock, AWS RestoreDBInstanceFromDBSnapshot, AWS SharedSnapshotCopyInitiated, AWS SharedSnapshotVolumeCreated, AWS StartExportTask, GCP storage.setIamPermissions", "enabled": true, "metadata": [], "links": [ { "label": "Azure CopyBlob", "url": "https://thecloud.events/events/azure-copyblob/" }, { "label": "AWS CopyObject", "url": "https://thecloud.events/events/aws-copyobject/" }, { "label": "AWS CreateDBSnapshot", "url": "https://thecloud.events/events/aws-createdbsnapshot/" }, { "label": "AWS CreateImage", "url": "https://thecloud.events/events/aws-createimage/" }, { "label": "AWS CreateInstanceExportTask", "url": "https://thecloud.events/events/aws-createinstanceexporttask/" }, { "label": "AWS CreateSnapshot", "url": "https://thecloud.events/events/aws-createsnapshot/" }, { "label": "AWS DeleteBucketPolicy", "url": "https://thecloud.events/events/aws-deletebucketpolicy/" }, { "label": "AWS GetObject", "url": "https://thecloud.events/events/aws-getobject/" }, { "label": "Azure Microsoft.Compute/disks/beginGetAccess/action", "url": "https://thecloud.events/events/azure-microsoft-compute-disks-begingetaccess-action/" }, { "label": "Azure Microsoft.Compute/snapshots/beginGetAccess/action", "url": "https://thecloud.events/events/azure-microsoft-compute-snapshots-begingetaccess-action/" }, { "label": "Azure Microsoft.Sql/servers/databases/export/action", "url": "https://thecloud.events/events/azure-microsoft-sql-servers-databases-export-action/" }, { "label": "AWS ModifyDBSnapshotAttribute", "url": "https://thecloud.events/events/aws-modifydbsnapshotattribute/" }, { "label": "AWS ModifyImageAttribute", "url": "https://thecloud.events/events/aws-modifyimageattribute/" }, { "label": "AWS ModifySnapshotAttribute", "url": "https://thecloud.events/events/aws-modifysnapshotattribute/" }, { "label": "AWS PutBucketAcl", "url": "https://thecloud.events/events/aws-putbucketacl/" }, { "label": "AWS PutBucketPolicy", "url": "https://thecloud.events/events/aws-putbucketpolicy/" }, { "label": "AWS PutBucketPublicAccessBlock", "url": "https://thecloud.events/events/aws-putbucketpublicaccessblock/" }, { "label": "AWS RestoreDBInstanceFromDBSnapshot", "url": "https://thecloud.events/events/aws-restoredbinstancefromdbsnapshot/" }, { "label": "AWS SharedSnapshotCopyInitiated", "url": "https://thecloud.events/events/aws-sharedsnapshotcopyinitiated/" }, { "label": "AWS SharedSnapshotVolumeCreated", "url": "https://thecloud.events/events/aws-sharedsnapshotvolumecreated/" }, { "label": "AWS StartExportTask", "url": "https://thecloud.events/events/aws-startexporttask/" }, { "label": "GCP storage.setIamPermissions", "url": "https://thecloud.events/events/gcp-storage-setiampermissions/" } ], "showSubtechniques": false }, { "techniqueID": "T1531", "score": 9, "color": "", "comment": "9 events in the catalog produce evidence for this technique: AWS ChangePassword, AWS DeleteAccessKey, AWS DeleteLoginProfile, AWS DeleteUser, GCP google.iam.admin.v1.DeleteServiceAccount, Azure Microsoft.Authorization/roleAssignments/delete, Azure Microsoft.Storage/storageAccounts/regenerateKey/action, AWS RemoveUserFromGroup, AWS UpdateLoginProfile", "enabled": true, "metadata": [], "links": [ { "label": "AWS ChangePassword", "url": "https://thecloud.events/events/aws-changepassword/" }, { "label": "AWS DeleteAccessKey", "url": "https://thecloud.events/events/aws-deleteaccesskey/" }, { "label": "AWS DeleteLoginProfile", "url": "https://thecloud.events/events/aws-deleteloginprofile/" }, { "label": "AWS DeleteUser", "url": "https://thecloud.events/events/aws-deleteuser/" }, { "label": "GCP google.iam.admin.v1.DeleteServiceAccount", "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-deleteserviceaccount/" }, { "label": "Azure Microsoft.Authorization/roleAssignments/delete", "url": "https://thecloud.events/events/azure-microsoft-authorization-roleassignments-delete/" }, { "label": "Azure Microsoft.Storage/storageAccounts/regenerateKey/action", "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-regeneratekey-action/" }, { "label": "AWS RemoveUserFromGroup", "url": "https://thecloud.events/events/aws-removeuserfromgroup/" }, { "label": "AWS UpdateLoginProfile", "url": "https://thecloud.events/events/aws-updateloginprofile/" } ], "showSubtechniques": false }, { "techniqueID": "T1535", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS EnableRegion", "enabled": true, "metadata": [], "links": [ { "label": "AWS EnableRegion", "url": "https://thecloud.events/events/aws-enableregion/" } ], "showSubtechniques": false }, { "techniqueID": "T1537", "score": 23, "color": "", "comment": "23 events in the catalog produce evidence for this technique: GCP bigquery.jobs.insert, GCP cloudsql.instances.export, Azure CopyBlob, AWS CopyObject, AWS CreateDBSnapshot, AWS CreateImage, AWS CreateInstanceExportTask, AWS CreateSnapshot, AWS GetObject, Azure Microsoft.Compute/disks/beginGetAccess/action, Azure Microsoft.Compute/snapshots/beginGetAccess/action, Azure Microsoft.Sql/servers/databases/export/action, AWS ModifyDBInstance, AWS ModifyDBSnapshotAttribute, AWS ModifyImageAttribute, AWS ModifySnapshotAttribute, AWS PutBucketAcl, AWS PutBucketPolicy, AWS PutBucketReplication, AWS RestoreDBInstanceFromDBSnapshot, AWS SharedSnapshotCopyInitiated, AWS SharedSnapshotVolumeCreated, AWS StartExportTask", "enabled": true, "metadata": [], "links": [ { "label": "GCP bigquery.jobs.insert", "url": "https://thecloud.events/events/gcp-bigquery-jobs-insert/" }, { "label": "GCP cloudsql.instances.export", "url": "https://thecloud.events/events/gcp-cloudsql-instances-export/" }, { "label": "Azure CopyBlob", "url": "https://thecloud.events/events/azure-copyblob/" }, { "label": "AWS CopyObject", "url": "https://thecloud.events/events/aws-copyobject/" }, { "label": "AWS CreateDBSnapshot", "url": "https://thecloud.events/events/aws-createdbsnapshot/" }, { "label": "AWS CreateImage", "url": "https://thecloud.events/events/aws-createimage/" }, { "label": "AWS CreateInstanceExportTask", "url": "https://thecloud.events/events/aws-createinstanceexporttask/" }, { "label": "AWS CreateSnapshot", "url": "https://thecloud.events/events/aws-createsnapshot/" }, { "label": "AWS GetObject", "url": "https://thecloud.events/events/aws-getobject/" }, { "label": "Azure Microsoft.Compute/disks/beginGetAccess/action", "url": "https://thecloud.events/events/azure-microsoft-compute-disks-begingetaccess-action/" }, { "label": "Azure Microsoft.Compute/snapshots/beginGetAccess/action", "url": "https://thecloud.events/events/azure-microsoft-compute-snapshots-begingetaccess-action/" }, { "label": "Azure Microsoft.Sql/servers/databases/export/action", "url": "https://thecloud.events/events/azure-microsoft-sql-servers-databases-export-action/" }, { "label": "AWS ModifyDBInstance", "url": "https://thecloud.events/events/aws-modifydbinstance/" }, { "label": "AWS ModifyDBSnapshotAttribute", "url": "https://thecloud.events/events/aws-modifydbsnapshotattribute/" }, { "label": "AWS ModifyImageAttribute", "url": "https://thecloud.events/events/aws-modifyimageattribute/" }, { "label": "AWS ModifySnapshotAttribute", "url": "https://thecloud.events/events/aws-modifysnapshotattribute/" }, { "label": "AWS PutBucketAcl", "url": "https://thecloud.events/events/aws-putbucketacl/" }, { "label": "AWS PutBucketPolicy", "url": "https://thecloud.events/events/aws-putbucketpolicy/" }, { "label": "AWS PutBucketReplication", "url": "https://thecloud.events/events/aws-putbucketreplication/" }, { "label": "AWS RestoreDBInstanceFromDBSnapshot", "url": "https://thecloud.events/events/aws-restoredbinstancefromdbsnapshot/" }, { "label": "AWS SharedSnapshotCopyInitiated", "url": "https://thecloud.events/events/aws-sharedsnapshotcopyinitiated/" }, { "label": "AWS SharedSnapshotVolumeCreated", "url": "https://thecloud.events/events/aws-sharedsnapshotvolumecreated/" }, { "label": "AWS StartExportTask", "url": "https://thecloud.events/events/aws-startexporttask/" } ], "showSubtechniques": false }, { "techniqueID": "T1546", "score": 8, "color": "", "comment": "8 events in the catalog produce evidence for this technique: AWS AddPermission20150331v2, Azure Microsoft.Automation/automationAccounts/runbooks/write, Azure Microsoft.Automation/automationAccounts/webhooks/write, Azure Microsoft.Compute/virtualMachines/extensions/write, Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension), AWS PutRule, AWS PutTargets, AWS UpdateFunctionCode20150331v2", "enabled": true, "metadata": [], "links": [ { "label": "AWS AddPermission20150331v2", "url": "https://thecloud.events/events/aws-addpermission20150331v2/" }, { "label": "Azure Microsoft.Automation/automationAccounts/runbooks/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-runbooks-write/" }, { "label": "Azure Microsoft.Automation/automationAccounts/webhooks/write", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-webhooks-write/" }, { "label": "Azure Microsoft.Compute/virtualMachines/extensions/write", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-extensions-write/" }, { "label": "Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-write-customscript/" }, { "label": "AWS PutRule", "url": "https://thecloud.events/events/aws-putrule/" }, { "label": "AWS PutTargets", "url": "https://thecloud.events/events/aws-puttargets/" }, { "label": "AWS UpdateFunctionCode20150331v2", "url": "https://thecloud.events/events/aws-updatefunctioncode20150331v2/" } ], "showSubtechniques": false }, { "techniqueID": "T1548", "score": 11, "color": "", "comment": "11 events in the catalog produce evidence for this technique: AWS AddRoleToInstanceProfile, AWS DeleteRolePermissionsBoundary, AWS DeleteRolePolicy, AWS DeleteUserPermissionsBoundary, AWS DeleteUserPolicy, AWS DetachRolePolicy, AWS DetachUserPolicy, GCP google.iam.admin.v1.SetIamPolicy, AWS PassRole, AWS PutRolePermissionsBoundary, AWS PutUserPermissionsBoundary", "enabled": true, "metadata": [], "links": [ { "label": "AWS AddRoleToInstanceProfile", "url": "https://thecloud.events/events/aws-addroletoinstanceprofile/" }, { "label": "AWS DeleteRolePermissionsBoundary", "url": "https://thecloud.events/events/aws-deleterolepermissionsboundary/" }, { "label": "AWS DeleteRolePolicy", "url": "https://thecloud.events/events/aws-deleterolepolicy/" }, { "label": "AWS DeleteUserPermissionsBoundary", "url": "https://thecloud.events/events/aws-deleteuserpermissionsboundary/" }, { "label": "AWS DeleteUserPolicy", "url": "https://thecloud.events/events/aws-deleteuserpolicy/" }, { "label": "AWS DetachRolePolicy", "url": "https://thecloud.events/events/aws-detachrolepolicy/" }, { "label": "AWS DetachUserPolicy", "url": "https://thecloud.events/events/aws-detachuserpolicy/" }, { "label": "GCP google.iam.admin.v1.SetIamPolicy", "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-setiampolicy-or-setiampolicy/" }, { "label": "AWS PassRole", "url": "https://thecloud.events/events/aws-passrole/" }, { "label": "AWS PutRolePermissionsBoundary", "url": "https://thecloud.events/events/aws-putrolepermissionsboundary/" }, { "label": "AWS PutUserPermissionsBoundary", "url": "https://thecloud.events/events/aws-putuserpermissionsboundary/" } ], "showSubtechniques": false }, { "techniqueID": "T1548.005", "score": 4, "color": "", "comment": "4 events in the catalog produce evidence for this technique: GCP generateAccessToken, GCP iam.serviceAccounts.actAs, GCP iam.serviceAccounts.implicitDelegation, GCP iam.serviceAccounts.signJwt", "enabled": true, "metadata": [], "links": [ { "label": "GCP generateAccessToken", "url": "https://thecloud.events/events/gcp-generateaccesstoken/" }, { "label": "GCP iam.serviceAccounts.actAs", "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-actas/" }, { "label": "GCP iam.serviceAccounts.implicitDelegation", "url": "https://thecloud.events/events/gcp-iam-serviceaccountkeys-implicitdelegation/" }, { "label": "GCP iam.serviceAccounts.signJwt", "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-signjwt/" } ], "showSubtechniques": false }, { "techniqueID": "T1550.001", "score": 4, "color": "", "comment": "4 events in the catalog produce evidence for this technique: AWS AssumeRole, AWS AssumeRoleWithSAML, AWS AssumeRoleWithWebIdentity, AWS GetSigninToken", "enabled": true, "metadata": [], "links": [ { "label": "AWS AssumeRole", "url": "https://thecloud.events/events/aws-assumerole/" }, { "label": "AWS AssumeRoleWithSAML", "url": "https://thecloud.events/events/aws-assumerolewithsaml/" }, { "label": "AWS AssumeRoleWithWebIdentity", "url": "https://thecloud.events/events/aws-assumerolewithwebidentity/" }, { "label": "AWS GetSigninToken", "url": "https://thecloud.events/events/aws-getsignintoken/" } ], "showSubtechniques": false }, { "techniqueID": "T1552", "score": 13, "color": "", "comment": "13 events in the catalog produce evidence for this technique: AWS GetAuthorizationToken, AWS GetPasswordData, Azure Microsoft.AppConfiguration/configurationStores/listKeys/action, Azure Microsoft.Automation/automationAccounts/credentials/read, Azure Microsoft.Batch/batchAccounts/listKeys/action, Azure Microsoft.ContainerRegistry/registries/listCredentials/action, Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action, Azure Microsoft.ContainerService/managedClusters/listClusterUserCredential/action, Azure Microsoft.OperationalInsights/workspaces/sharedKeys/action, Azure Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action, Azure Microsoft.Storage/storageAccounts/listKeys/action, Azure Microsoft.Storage/storageAccounts/regenerateKey/action, Azure Microsoft.Web/sites/host/listKeys/action", "enabled": true, "metadata": [], "links": [ { "label": "AWS GetAuthorizationToken", "url": "https://thecloud.events/events/aws-getauthorizationtoken/" }, { "label": "AWS GetPasswordData", "url": "https://thecloud.events/events/aws-getpassworddata/" }, { "label": "Azure Microsoft.AppConfiguration/configurationStores/listKeys/action", "url": "https://thecloud.events/events/azure-microsoft-appconfiguration-configurationstores-listkeys-action/" }, { "label": "Azure Microsoft.Automation/automationAccounts/credentials/read", "url": "https://thecloud.events/events/azure-microsoft-automation-automationaccounts-credentials-read/" }, { "label": "Azure Microsoft.Batch/batchAccounts/listKeys/action", "url": "https://thecloud.events/events/azure-microsoft-batch-batchaccounts-listkeys-action/" }, { "label": "Azure Microsoft.ContainerRegistry/registries/listCredentials/action", "url": "https://thecloud.events/events/azure-microsoft-containerregistry-registries-listcredentials-action/" }, { "label": "Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action", "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-listclusteradmincredential-action/" }, { "label": "Azure Microsoft.ContainerService/managedClusters/listClusterUserCredential/action", "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-listclusterusercredential-action/" }, { "label": "Azure Microsoft.OperationalInsights/workspaces/sharedKeys/action", "url": "https://thecloud.events/events/azure-microsoft-operationalinsights-workspaces-sharedkeys-action/" }, { "label": "Azure Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action", "url": "https://thecloud.events/events/azure-microsoft-servicebus-namespaces-authorizationrules-listkeys-action/" }, { "label": "Azure Microsoft.Storage/storageAccounts/listKeys/action", "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-listkeys-action/" }, { "label": "Azure Microsoft.Storage/storageAccounts/regenerateKey/action", "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-regeneratekey-action/" }, { "label": "Azure Microsoft.Web/sites/host/listKeys/action", "url": "https://thecloud.events/events/azure-microsoft-web-sites-host-listkeys-action/" } ], "showSubtechniques": false }, { "techniqueID": "T1555.006", "score": 7, "color": "", "comment": "7 events in the catalog produce evidence for this technique: AWS GetParameters, AWS GetSecretValue, Azure Microsoft.KeyVault/vaults/certificates/read, Azure Microsoft.KeyVault/vaults/keys/read, Azure Microsoft.KeyVault/vaults/secrets/read, GCP SecretManagerService.AccessSecretVersion, Azure VaultPatch", "enabled": true, "metadata": [], "links": [ { "label": "AWS GetParameters", "url": "https://thecloud.events/events/aws-getparameters/" }, { "label": "AWS GetSecretValue", "url": "https://thecloud.events/events/aws-getsecretvalue/" }, { "label": "Azure Microsoft.KeyVault/vaults/certificates/read", "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-certificates-read/" }, { "label": "Azure Microsoft.KeyVault/vaults/keys/read", "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-keys-read/" }, { "label": "Azure Microsoft.KeyVault/vaults/secrets/read", "url": "https://thecloud.events/events/azure-microsoft-keyvault-vaults-secrets-read/" }, { "label": "GCP SecretManagerService.AccessSecretVersion", "url": "https://thecloud.events/events/gcp-secretmanagerservice-accesssecretversion/" }, { "label": "Azure VaultPatch", "url": "https://thecloud.events/events/azure-vaultpatch/" } ], "showSubtechniques": false }, { "techniqueID": "T1556", "score": 2, "color": "", "comment": "2 events in the catalog produce evidence for this technique: AWS CreateOpenIDConnectProvider, AWS CreateSAMLProvider", "enabled": true, "metadata": [], "links": [ { "label": "AWS CreateOpenIDConnectProvider", "url": "https://thecloud.events/events/aws-createopenidconnectprovider/" }, { "label": "AWS CreateSAMLProvider", "url": "https://thecloud.events/events/aws-createsamlprovider/" } ], "showSubtechniques": false }, { "techniqueID": "T1556.006", "score": 5, "color": "", "comment": "5 events in the catalog produce evidence for this technique: Azure Admin Registered Security Info, AWS DeactivateMFADevice, AWS DeleteVirtualMFADevice, Azure Disable Strong Authentication, Azure Update User Authentication Methods", "enabled": true, "metadata": [], "links": [ { "label": "Azure Admin Registered Security Info", "url": "https://thecloud.events/events/azure-admin-registered-security-info/" }, { "label": "AWS DeactivateMFADevice", "url": "https://thecloud.events/events/aws-deactivatemfadevice/" }, { "label": "AWS DeleteVirtualMFADevice", "url": "https://thecloud.events/events/aws-deletevirtualmfadevice/" }, { "label": "Azure Disable Strong Authentication", "url": "https://thecloud.events/events/azure-disable-strong-authentication/" }, { "label": "Azure Update User Authentication Methods", "url": "https://thecloud.events/events/azure-update-user-authentication-methods/" } ], "showSubtechniques": false }, { "techniqueID": "T1556.009", "score": 2, "color": "", "comment": "2 events in the catalog produce evidence for this technique: Azure Update Conditional Access Policy, Azure Update named location", "enabled": true, "metadata": [], "links": [ { "label": "Azure Update Conditional Access Policy", "url": "https://thecloud.events/events/azure-update-conditional-access-policy/" }, { "label": "Azure Update named location", "url": "https://thecloud.events/events/azure-update-named-location/" } ], "showSubtechniques": false }, { "techniqueID": "T1578", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS ModifyInstanceAttribute", "enabled": true, "metadata": [], "links": [ { "label": "AWS ModifyInstanceAttribute", "url": "https://thecloud.events/events/aws-modifyinstanceattribute/" } ], "showSubtechniques": false }, { "techniqueID": "T1578.003", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Compute/virtualMachines/delete", "enabled": true, "metadata": [], "links": [ { "label": "Azure Microsoft.Compute/virtualMachines/delete", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-delete/" } ], "showSubtechniques": false }, { "techniqueID": "T1599", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write", "enabled": true, "metadata": [], "links": [ { "label": "Azure Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write", "url": "https://thecloud.events/events/azure-microsoft-network-virtualnetworkpeerings-write/" } ], "showSubtechniques": false }, { "techniqueID": "T1609", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: Azure Microsoft.ContainerService/managedClusters/runCommand/action", "enabled": true, "metadata": [], "links": [ { "label": "Azure Microsoft.ContainerService/managedClusters/runCommand/action", "url": "https://thecloud.events/events/azure-microsoft-containerservice-managedclusters-runcommand-action/" } ], "showSubtechniques": false }, { "techniqueID": "T1648", "score": 1, "color": "", "comment": "1 event in the catalog produce evidence for this technique: AWS Invoke", "enabled": true, "metadata": [], "links": [ { "label": "AWS Invoke", "url": "https://thecloud.events/events/aws-invoke/" } ], "showSubtechniques": false }, { "techniqueID": "T1651", "score": 7, "color": "", "comment": "7 events in the catalog produce evidence for this technique: AWS CreateAssociation, Azure Microsoft.Compute/virtualMachines/extensions/write, Azure Microsoft.Compute/virtualMachines/runCommand/action, Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension), AWS ResumeSession, AWS SendCommand, AWS StartSession", "enabled": true, "metadata": [], "links": [ { "label": "AWS CreateAssociation", "url": "https://thecloud.events/events/aws-createassociation/" }, { "label": "Azure Microsoft.Compute/virtualMachines/extensions/write", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-extensions-write/" }, { "label": "Azure Microsoft.Compute/virtualMachines/runCommand/action", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-runcommand-action/" }, { "label": "Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)", "url": "https://thecloud.events/events/azure-microsoft-compute-virtualmachines-write-customscript/" }, { "label": "AWS ResumeSession", "url": "https://thecloud.events/events/aws-resumesession/" }, { "label": "AWS SendCommand", "url": "https://thecloud.events/events/aws-sendcommand/" }, { "label": "AWS StartSession", "url": "https://thecloud.events/events/aws-startsession/" } ], "showSubtechniques": false }, { "techniqueID": "T1685", "score": 33, "color": "", "comment": "33 events in the catalog produce evidence for this technique: AWS ArchiveFindings, AWS CreateFilter, AWS CreateIPSet, AWS DeleteAlarms, AWS DeleteBucket, AWS DeleteConfigRule, AWS DeleteConfigurationRecorder, AWS DeleteDeliveryChannel, AWS DeleteDetector, AWS DeleteLoginProfile, AWS DeleteMembers, AWS DeleteRolePolicy, AWS DeleteUserPolicy, AWS DetachRolePolicy, AWS DetachUserPolicy, AWS DisassociateFromMasterAccount, AWS DisassociateMembers, GCP google.cloud.securitycenter.v1.SecurityCenter.SetMute, AWS LeaveOrganization, Azure Microsoft.HybridCompute/machines/extensions/delete, Azure Microsoft.Insights/activityLogAlerts/delete, Azure Microsoft.Insights/metricAlerts/delete, Azure Microsoft.Security/alertsSuppressionRules/write, Azure Microsoft.Security/autoProvisioningSettings/write, Azure Microsoft.Security/pricings/write, Azure Microsoft.Security/securitySolutions/delete, AWS RemoveAccountFromOrganization, AWS ScheduleKeyDeletion, GCP Securitycenter.settings.update, AWS StopConfigurationRecorder, AWS StopMonitoringMembers, AWS UpdateDetector, AWS UpdateIPSet", "enabled": true, "metadata": [], "links": [ { "label": "AWS ArchiveFindings", "url": "https://thecloud.events/events/aws-archivefindings/" }, { "label": "AWS CreateFilter", "url": "https://thecloud.events/events/aws-createfilter/" }, { "label": "AWS CreateIPSet", "url": "https://thecloud.events/events/aws-createipset/" }, { "label": "AWS DeleteAlarms", "url": "https://thecloud.events/events/aws-deletealarms/" }, { "label": "AWS DeleteBucket", "url": "https://thecloud.events/events/aws-deletebucket/" }, { "label": "AWS DeleteConfigRule", "url": "https://thecloud.events/events/aws-deleteconfigrule/" }, { "label": "AWS DeleteConfigurationRecorder", "url": "https://thecloud.events/events/aws-deleteconfigurationrecorder/" }, { "label": "AWS DeleteDeliveryChannel", "url": "https://thecloud.events/events/aws-deletedeliverychannel/" }, { "label": "AWS DeleteDetector", "url": "https://thecloud.events/events/aws-deletedetector/" }, { "label": "AWS DeleteLoginProfile", "url": "https://thecloud.events/events/aws-deleteloginprofile/" }, { "label": "AWS DeleteMembers", "url": "https://thecloud.events/events/aws-deletemembers/" }, { "label": "AWS DeleteRolePolicy", "url": "https://thecloud.events/events/aws-deleterolepolicy/" }, { "label": "AWS DeleteUserPolicy", "url": "https://thecloud.events/events/aws-deleteuserpolicy/" }, { "label": "AWS DetachRolePolicy", "url": "https://thecloud.events/events/aws-detachrolepolicy/" }, { "label": "AWS DetachUserPolicy", "url": "https://thecloud.events/events/aws-detachuserpolicy/" }, { "label": "AWS DisassociateFromMasterAccount", "url": "https://thecloud.events/events/aws-disassociatefrommasteraccount/" }, { "label": "AWS DisassociateMembers", "url": "https://thecloud.events/events/aws-disassociatemembers/" }, { "label": "GCP google.cloud.securitycenter.v1.SecurityCenter.SetMute", "url": "https://thecloud.events/events/gcp-google-cloud-securitycenter-v1-securitycenter-setmute/" }, { "label": "AWS LeaveOrganization", "url": "https://thecloud.events/events/aws-leaveorganization/" }, { "label": "Azure Microsoft.HybridCompute/machines/extensions/delete", "url": "https://thecloud.events/events/azure-microsoft-hybridcomputer-machines-extensions-delete/" }, { "label": "Azure Microsoft.Insights/activityLogAlerts/delete", "url": "https://thecloud.events/events/azure-microsoft-insights-activitylogalerts-delete/" }, { "label": "Azure Microsoft.Insights/metricAlerts/delete", "url": "https://thecloud.events/events/azure-microsoft-insights-metricalerts-delete/" }, { "label": "Azure Microsoft.Security/alertsSuppressionRules/write", "url": "https://thecloud.events/events/azure-microsoft-security-alertssuppressionrules-write/" }, { "label": "Azure Microsoft.Security/autoProvisioningSettings/write", "url": "https://thecloud.events/events/azure-microsoft-security-autoprovisioningsettings-write/" }, { "label": "Azure Microsoft.Security/pricings/write", "url": "https://thecloud.events/events/azure-microsoft-security-pricings-write/" }, { "label": "Azure Microsoft.Security/securitySolutions/delete", "url": "https://thecloud.events/events/azure-microsoft-security-securitysolutions-delete/" }, { "label": "AWS RemoveAccountFromOrganization", "url": "https://thecloud.events/events/aws-removeaccountfromorganization/" }, { "label": "AWS ScheduleKeyDeletion", "url": "https://thecloud.events/events/aws-schedulekeydeletion/" }, { "label": "GCP Securitycenter.settings.update", "url": "https://thecloud.events/events/gcp-securitycenter-settings-update/" }, { "label": "AWS StopConfigurationRecorder", "url": "https://thecloud.events/events/aws-stopconfigurationrecorder/" }, { "label": "AWS StopMonitoringMembers", "url": "https://thecloud.events/events/aws-stopmonitoringmembers/" }, { "label": "AWS UpdateDetector", "url": "https://thecloud.events/events/aws-updatedetector/" }, { "label": "AWS UpdateIPSet", "url": "https://thecloud.events/events/aws-updateipset/" } ], "showSubtechniques": false }, { "techniqueID": "T1685.002", "score": 20, "color": "", "comment": "20 events in the catalog produce evidence for this technique: AWS DeleteEventDataStore, AWS DeleteFlowLogs, AWS DeleteLogGroup, AWS DeleteLogStream, AWS DeleteObjects, AWS DeleteTrail, GCP google.logging.v2.ConfigServiceV2.UpdateExclusion, GCP google.logging.v2.LoggingServiceV2.DeleteLog, GCP logging.projects.exclusions.create, GCP logging.sinks.delete, GCP logging.sinks.update, Azure Microsoft.EventHub/namespaces/eventhubs/delete, Azure Microsoft.Insights/diagnosticSettings/delete, Azure Microsoft.Network/networkWatchers/flowLogs/delete, Azure Microsoft.OperationalInsights/workspaces/delete, Azure Microsoft.Storage/storageAccounts/stopLogging/action, AWS PutBucketLifecycleConfiguration, AWS PutEventSelectors, AWS StopLogging, AWS UpdateTrail", "enabled": true, "metadata": [], "links": [ { "label": "AWS DeleteEventDataStore", "url": "https://thecloud.events/events/aws-deleteeventdatastore/" }, { "label": "AWS DeleteFlowLogs", "url": "https://thecloud.events/events/aws-deleteflowlogs/" }, { "label": "AWS DeleteLogGroup", "url": "https://thecloud.events/events/aws-deleteloggroup/" }, { "label": "AWS DeleteLogStream", "url": "https://thecloud.events/events/aws-deletelogstream/" }, { "label": "AWS DeleteObjects", "url": "https://thecloud.events/events/aws-deleteobjects/" }, { "label": "AWS DeleteTrail", "url": "https://thecloud.events/events/aws-deletetrail/" }, { "label": "GCP google.logging.v2.ConfigServiceV2.UpdateExclusion", "url": "https://thecloud.events/events/gcp-google-logging-v2-configservicev2-updateexclusion/" }, { "label": "GCP google.logging.v2.LoggingServiceV2.DeleteLog", "url": "https://thecloud.events/events/gcp-google-logging-v2-loggingservicev2-deletelog/" }, { "label": "GCP logging.projects.exclusions.create", "url": "https://thecloud.events/events/gcp-logging-projects-exclusions-create/" }, { "label": "GCP logging.sinks.delete", "url": "https://thecloud.events/events/gcp-logging-sinks-delete/" }, { "label": "GCP logging.sinks.update", "url": "https://thecloud.events/events/gcp-logging-sinks-update/" }, { "label": "Azure Microsoft.EventHub/namespaces/eventhubs/delete", "url": "https://thecloud.events/events/azure-microsoft-eventhub-namespaces-eventhubs-delete/" }, { "label": "Azure Microsoft.Insights/diagnosticSettings/delete", "url": "https://thecloud.events/events/azure-microsoft-insights-diagnosticsettings-delete/" }, { "label": "Azure Microsoft.Network/networkWatchers/flowLogs/delete", "url": "https://thecloud.events/events/azure-microsoft-network-networkwatchers-flowlogs-delete/" }, { "label": "Azure Microsoft.OperationalInsights/workspaces/delete", "url": "https://thecloud.events/events/azure-microsoft-operationalinsights-workspaces-delete/" }, { "label": "Azure Microsoft.Storage/storageAccounts/stopLogging/action", "url": "https://thecloud.events/events/azure-microsoft-storage-storageaccounts-stoplogging-action/" }, { "label": "AWS PutBucketLifecycleConfiguration", "url": "https://thecloud.events/events/aws-putbucketlifecycleconfiguration/" }, { "label": "AWS PutEventSelectors", "url": "https://thecloud.events/events/aws-puteventselectors/" }, { "label": "AWS StopLogging", "url": "https://thecloud.events/events/aws-stoplogging/" }, { "label": "AWS UpdateTrail", "url": "https://thecloud.events/events/aws-updatetrail/" } ], "showSubtechniques": false }, { "techniqueID": "T1686.001", "score": 13, "color": "", "comment": "13 events in the catalog produce evidence for this technique: AWS AuthorizeDBSecurityGroupIngress, AWS AuthorizeSecurityGroupEgress, AWS AuthorizeSecurityGroupIngress, GCP compute.firewalls.delete, GCP compute.firewalls.patch, AWS CreateNetworkAclEntry, AWS DeleteNetworkAcl, AWS DeleteNetworkAclEntry, AWS DeleteRuleGroup, AWS DeleteWebACL, Azure Microsoft.Network/networkSecurityGroups/delete, Azure Microsoft.Network/networkSecurityGroups/securityRules/write, Azure VaultPatch", "enabled": true, "metadata": [], "links": [ { "label": "AWS AuthorizeDBSecurityGroupIngress", "url": "https://thecloud.events/events/aws-authorizedbsecuritygroupingress/" }, { "label": "AWS AuthorizeSecurityGroupEgress", "url": "https://thecloud.events/events/aws-authorizesecuritygroupegress/" }, { "label": "AWS AuthorizeSecurityGroupIngress", "url": "https://thecloud.events/events/aws-authorizesecuritygroupingress/" }, { "label": "GCP compute.firewalls.delete", "url": "https://thecloud.events/events/gcp-compute-firewalls-delete/" }, { "label": "GCP compute.firewalls.patch", "url": "https://thecloud.events/events/gcp-compute-firewalls-patch/" }, { "label": "AWS CreateNetworkAclEntry", "url": "https://thecloud.events/events/aws-createnetworkaclentry/" }, { "label": "AWS DeleteNetworkAcl", "url": "https://thecloud.events/events/aws-deletenetworkacl/" }, { "label": "AWS DeleteNetworkAclEntry", "url": "https://thecloud.events/events/aws-deletenetworkaclentry/" }, { "label": "AWS DeleteRuleGroup", "url": "https://thecloud.events/events/aws-deleterulegroup/" }, { "label": "AWS DeleteWebACL", "url": "https://thecloud.events/events/aws-deletewebacl/" }, { "label": "Azure Microsoft.Network/networkSecurityGroups/delete", "url": "https://thecloud.events/events/azure-microsoft-network-networksecuritygroups-delete/" }, { "label": "Azure Microsoft.Network/networkSecurityGroups/securityRules/write", "url": "https://thecloud.events/events/azure-microsoft-network-networksecuritygroups-securityrules-write/" }, { "label": "Azure VaultPatch", "url": "https://thecloud.events/events/azure-vaultpatch/" } ], "showSubtechniques": false } ], "gradient": { "colors": [ "#ffffff", "#5c6b73" ], "minValue": 0, "maxValue": 40 }, "legendItems": [ { "label": "More catalog events produce evidence for this technique", "color": "#5c6b73" } ], "metadata": [ { "name": "source", "value": "https://thecloud.events" }, { "name": "scope", "value": "AWS + Azure + GCP" } ], "links": [ { "label": "TheCloud.Events", "url": "https://thecloud.events/" } ], "showTacticRowBackground": false, "tacticRowBackground": "#dddddd", "selectTechniquesAcrossTactics": true, "selectSubtechniquesWithParent": false }