MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Persistence/ T1098.003

T1098.003Additional Cloud Roles

T1098.003 — Additional Cloud Roles is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 24 detection use cases covering it and 3 threat-intel articles citing it.

PersistencePrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

24Use cases

3Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1098 · Account Manipulation

Use cases covering this technique (24)

AWS IAM policy created / updated / version changed Internal install · alerting DDCW Google Workspace admin role assigned to user Internal install · alerting DD Azure AD Admin Consent Bypassed by Service Principal ESCU actions · alerting P Azure AD Application Administrator Role Assigned ESCU actions · alerting P Azure AD FullAccessAsApp Permission Assigned ESCU actions · alerting P Azure AD Global Administrator Role Assigned ESCU actions · alerting P Azure AD PIM Role Assigned ESCU actions · alerting P Azure AD PIM Role Assignment Activated ESCU actions · alerting P Azure AD Privileged Role Assigned ESCU actions · alerting P Azure AD Privileged Role Assigned to Service Principal ESCU actions · alerting P Azure AD Service Principal Privilege Escalation ESCU actions · alerting P Azure AD Tenant Wide Admin Consent Granted ESCU actions · alerting P O365 Admin Consent Bypassed by Service Principal ESCU actions · alerting P O365 Application Available To Other Tenants ESCU actions · alerting P O365 FullAccessAsApp Permission Assigned ESCU actions · alerting P O365 High Privilege Role Granted ESCU actions · alerting P O365 Mailbox Read Access Granted to Application ESCU actions · alerting P O365 Privileged Role Assigned ESCU actions · alerting P O365 Privileged Role Assigned To Service Principal ESCU actions · alerting P O365 Service Principal Privilege Escalation ESCU actions · alerting P O365 Tenant Wide Admin Consent Granted ESCU actions · alerting P [LLM] Suspicious OAuth application consent granting broad scopes (ShinyHunters DataLoader-style persistence) Bespoke c2 · hunting DSΣPDD [LLM] Unauthenticated 9router provider CRUD mutation (rogue-provider / key-swap / DoS) Bespoke actions · alerting SΣP [LLM] BodySnatcher post-exploit: backdoor admin account / role grant via ServiceNow AI agent Bespoke install · alerting SP

Articles citing this technique (3)

high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-07

crit [GHSA / CRITICAL] GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats art-237

high AI Is Building Your Attack Surface. Are You Testing It? art-578