Azure Add App Role Assignment To Service Principal
Grants a resource application role to a client service principal.
Persistence
Persistence
Section titled “Persistence”The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.
In cloud environments, adversaries persist by creating new IAM users or roles, attaching policies that grant backdoor access, deploying long-lived API keys, or modifying identity federation settings. They may also create resources like Lambda functions or scheduled tasks that maintain their access even if initial credentials are revoked.
View Persistence on MITRE ATT&CK →Events Related to Persistence
Section titled “Events Related to Persistence”Explore this tactic in the map.
Azure Add Application
Creates an application registration in Microsoft Entra ID.
Azure Add Eligible Member To Role In Pim Completed
Records completed creation of PIM role eligibility.
Azure Add Federated Identity Credential
Adds an external workload trust to a Microsoft Entra application registration.
Azure Add Member To Role
Adds a principal to a Microsoft Entra directory role.
Azure Add Owner To Application
Adds an owner to a Microsoft Entra application registration.
Azure Add Owner To Group
Adds an owner to a Microsoft Entra group.
Azure Add Role Definition (Azure RBAC)
Creates a custom Azure resource RBAC role definition.
Azure Add Service Principal
Creates a tenant-local service principal in Microsoft Entra ID.
Azure Add User
Creates a user object in Microsoft Entra ID.
GCP add-iam-policy-binding
Adds a role binding through a resource-specific IAM policy update.
AWS AddPermission20150331v2
Adds a statement to a Lambda resource-based policy.
AWS AddRoleToInstanceProfile
Adds one IAM role to an existing instance profile.
AWS AddUserToGroup
Adds an IAM user to a group, changing the policies that apply to the user.
Azure Admin Registered Security Info
Records an administrator registering user authentication information.
AWS AttachGroupPolicy
Attaches a managed permissions policy to an IAM group.
AWS AttachRolePolicy
Attaches a managed permissions policy to an IAM role.
AWS AttachUserPolicy
Attaches a managed permissions policy to an IAM user.
AWS ChangePassword
Changes the calling IAM user’s console password.
GCP compute.disks.setIamPolicy
Replaces the IAM allow policy on a Compute Engine persistent disk.
GCP compute.instances.setMetadata
Replaces instance-level metadata on a Compute Engine VM.
GCP compute.projects.setCommonInstanceMetadata
Replaces project-wide Compute Engine metadata.
Azure Consent To Application
Records consent to an application’s requested permissions.
AWS CreateAccessEntry
Creates an EKS access entry for an existing IAM principal.
AWS CreateAccessKey
Creates a new long-term access key for an IAM user, enabling programmatic access to AWS services.
AWS CreateAccount
Requests creation of an AWS Organizations member account.
AWS CreateAssociation
Creates a Systems Manager State Manager association.
AWS CreateKeyPair
Creates an EC2 key pair and returns its private key to the API caller.
AWS CreateLoginProfile
Creates a console password for an IAM user.
AWS CreateOpenIDConnectProvider
Registers an OIDC identity provider in IAM.
AWS CreatePolicy
Creates a customer-managed IAM policy with an initial default version.
AWS CreatePolicyVersion
Creates a customer-managed policy version, optionally making it the operative version.
AWS CreateRole
Creates an IAM role with a trust policy and optional role settings.
AWS CreateSAMLProvider
Registers SAML identity-provider metadata in IAM.
AWS CreateUser
Creates an IAM user without automatically creating sign-in credentials.
AWS CreateVirtualMFADevice
Creates a virtual MFA device that must be enabled separately for an IAM user.
AWS DeleteRolePolicy
Deletes a named inline permissions policy from an IAM role.
AWS DeleteUserPolicy
Deletes a named inline permissions policy from an IAM user.
AWS DeleteVirtualMFADevice
Deletes an unassigned virtual MFA device resource.
AWS DetachRolePolicy
Detaches a managed policy from an IAM role without deleting the policy.
AWS DetachUserPolicy
Detaches a managed policy from an IAM user without deleting the policy.
Azure Disable Strong Authentication
Records removal of a user’s per-user MFA requirement.
GCP EnableServiceAccount
Enables a disabled service account.
AWS GetAuthorizationToken
Requests a temporary authentication token for private Amazon ECR registries.
AWS GetFederationToken
Issues temporary federated-user credentials using long-term IAM-user credentials.
AWS GetSessionToken
Issues temporary credentials for an IAM user, optionally with MFA context.
GCP google.iam.admin.v1.CreateServiceAccountKey
Creates a user-managed service-account key.
GCP google.iam.admin.v1.SetIAMPolicy
Sets the IAM allow policy on a service account.
GCP google.iam.admin.v1.UploadServiceAccountKey
Uploads a public key certificate for a service account.
GCP iam.roles.update
Updates a custom IAM role definition.
AWS ImportKeyPair
Registers an existing public key as an EC2 key pair.
Azure Invite External User
Invites an external identity to collaborate in a Microsoft Entra tenant.
Azure Microsoft.Authorization/roleAssignments/write
Creates or updates an Azure RBAC role assignment, granting a principal specific permissions on a resource or scope.
Azure Microsoft.Automation/automationAccounts/webhooks/write
Creates or updates an Azure Automation runbook webhook.
Azure Microsoft.Directory/groups/members/update
Updates membership of an Entra group that is not role-assignable.
Azure Microsoft.Directory/servicePrincipals/credentials/update
Adds or updates credentials on an Entra service principal.
Azure Microsoft.KeyVault/vaults/accessPolicies/write
Changes access-policy entries for an Azure Key Vault.
Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
Authorizes attaching an existing user-assigned managed identity to a resource.
AWS PutGroupPolicy
Adds or replaces a named inline permissions policy on an IAM group.
AWS PutImage
Registers an ECR image manifest and associated tag after layer upload.
AWS PutRolePolicy
Adds or replaces a named inline permissions policy on an IAM role.
AWS PutRule
Creates or updates an EventBridge rule.
AWS PutTargets
Adds or updates targets associated with an EventBridge rule.
AWS PutUserPolicy
Adds or replaces a named inline permissions policy on an IAM user.
Azure Reset User Password
Records an administrative password reset for a Microsoft Entra user.
AWS SetDefaultPolicyVersion
Selects an existing customer-managed IAM policy version as the operative version.
GCP storage.hmacKeys.create
Creates an HMAC key for a service account’s Cloud Storage XML API access.
GCP storage.setIamPermissions
Records a Cloud Storage access-policy change; this example changes bucket IAM.
Azure Update Role Definition (Azure RBAC)
Updates a custom Azure resource RBAC role definition.
Azure Update User Authentication Methods
Records changes to a user’s registered Entra authentication methods.
AWS UpdateAccessKey
Sets an IAM access key to Active or Inactive.
AWS UpdateAssumeRolePolicy
Replaces an IAM role trust policy, changing the conditions for assuming it.
AWS UpdateFunctionCode20150331v2
Updates the unpublished code of a Lambda function.
AWS UpdateFunctionConfiguration20150331v2
Updates a Lambda function’s unpublished configuration.
AWS UpdateLoginProfile
Updates an IAM user console password or password-reset requirement.
GCP users.importSshPublicKey
Imports an SSH public key into an OS Login profile.
GCP users.sshPublicKeys.patch
Updates an existing OS Login SSH public-key record; the method is not audit-logged.