TA0001 · INITIAL ACCESS
Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Detect it with
Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.
Why it matters on shift
Cloud Accounts is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
Kill-chain context