Skip to content

T1078.004: Cloud Accounts

T1078.004: Cloud Accounts

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of r...

View on MITRE ATT&CK →

AWS AssumeRole

Returns temporary security credentials for assuming an IAM role. Allows an entity (user, service, or account) to act with the role's permissions.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004 T1550.001

Tags:

AWS AssumeRoleWithSAML

Exchanges a validated SAML assertion for temporary IAM role credentials.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004 T1550.001

Tags:

AWS AssumeRoleWithWebIdentity

Exchanges a web-identity token for temporary IAM role credentials.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004 T1550.001

Tags:

AWS ConsoleLogin

Records a sign-in attempt to the AWS Management Console, capturing success or failure status and whether MFA was used.

Cloud Service: AWS - SignIn

Tactics:

Initial Access Stealth

Techniques:

Tags:

AWS GetAuthorizationToken

Requests a temporary authentication token for private Amazon ECR registries.

Cloud Service: AWS - ECR

Tactics:

Initial Access Persistence Privilege Escalation Stealth

Techniques:

Tags:

AWS GetFederationToken

Issues temporary federated-user credentials using long-term IAM-user credentials.

Cloud Service: AWS - STS

Tactics:

Initial Access Persistence Privilege Escalation Stealth

Techniques:

Tags:

AWS GetSessionToken

Issues temporary credentials for an IAM user, optionally with MFA context.

Cloud Service: AWS - STS

Tactics:

Initial Access Persistence Privilege Escalation Stealth

Techniques:

Tags: