Azure Add Owner To Application
Adds an owner to a Microsoft Entra application registration.
T1098: Account Manipulation
T1098: Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...
View on MITRE ATT&CK →Azure Add Owner To Group
Adds an owner to a Microsoft Entra group.
AWS AddPermission20150331v2
Adds a statement to a Lambda resource-based policy.
AWS AddRoleToInstanceProfile
Adds one IAM role to an existing instance profile.
AWS AddUserToGroup
Adds an IAM user to a group, changing the policies that apply to the user.
Azure Admin Registered Security Info
Records an administrator registering user authentication information.
AWS AssociateIamInstanceProfile
Associates an instance profile with a running or stopped EC2 instance.
AWS AttachGroupPolicy
Attaches a managed permissions policy to an IAM group.
AWS AttachRolePolicy
Attaches a managed permissions policy to an IAM role.
AWS AttachUserPolicy
Attaches a managed permissions policy to an IAM user.
AWS ChangePassword
Changes the calling IAM user’s console password.
GCP compute.instances.setServiceAccount
Changes a VM’s attached service account and access scopes.
Azure Consent To Application
Records consent to an application’s requested permissions.
AWS CreateAccessEntry
Creates an EKS access entry for an existing IAM principal.
AWS CreateDevEndpoint
Creates a legacy AWS Glue development endpoint.
AWS CreatePolicy
Creates a customer-managed IAM policy with an initial default version.
AWS CreatePolicyVersion
Creates a customer-managed policy version, optionally making it the operative version.
AWS DeleteRolePolicy
Deletes a named inline permissions policy from an IAM role.
AWS DeleteUserPolicy
Deletes a named inline permissions policy from an IAM user.
AWS DetachRolePolicy
Detaches a managed policy from an IAM role without deleting the policy.
AWS DetachUserPolicy
Detaches a managed policy from an IAM user without deleting the policy.
GCP EnableServiceAccount
Enables a disabled service account.
GCP iam.roles.update
Updates a custom IAM role definition.
Azure Microsoft.KeyVault/vaults/accessPolicies/write
Changes access-policy entries for an Azure Key Vault.
Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
Authorizes attaching an existing user-assigned managed identity to a resource.
AWS PutGroupPolicy
Adds or replaces a named inline permissions policy on an IAM group.
AWS PutKeyPolicy
Replaces the policy on a KMS key.
AWS PutRolePolicy
Adds or replaces a named inline permissions policy on an IAM role.
AWS PutUserPolicy
Adds or replaces a named inline permissions policy on an IAM user.
AWS ReplaceIamInstanceProfileAssociation
Replaces the instance profile associated with a running EC2 instance.
Azure Reset User Password
Records an administrative password reset for a Microsoft Entra user.
AWS SetDefaultPolicyVersion
Selects an existing customer-managed IAM policy version as the operative version.
Azure Update User Authentication Methods
Records changes to a user’s registered Entra authentication methods.
AWS UpdateAccessKey
Sets an IAM access key to Active or Inactive.
AWS UpdateAssumeRolePolicy
Replaces an IAM role trust policy, changing the conditions for assuming it.
AWS UpdateDevEndpoint
Changes a Glue development endpoint’s keys, arguments, or libraries.
AWS UpdateFunctionConfiguration20150331v2
Updates a Lambda function’s unpublished configuration.
AWS UpdateLoginProfile
Updates an IAM user console password or password-reset requirement.