Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1136.003_cloud-account
Adversaries may create a cloud account to maintain access to victim systems.
Passed 21 of 22 test cases with the skill, and 16 of 22 without it.
and 4 more in the full report
5 fixed16 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
We recently noticed suspicious persistence activity in our multi-cloud deployment. Can you produce a security posture assessment covering sub-technique T1136.003? Please format it as a report outlining the target environment audit checks, key mitigation controls to evaluate, and the overall risk severity rating for this behavior.
| Checked | Without skill | With skill |
|---|---|---|
| Includes M1030 Network Segmentation in the recommended mitigation evaluation | Missed | Passed |
| Includes audit checks across SaaS and Office Suite platforms alongside IaaS | Missed | Passed |
| Rates the overall risk severity as High | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1136
Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.
In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment. In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for Temporary Elevated Cloud Access. While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.
Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.
Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding Additional Cloud Credentials or assigning Additional Cloud Roles.
Platforms: IaaS, SaaS, Office Suite, Identity Provider
Identify Attack Surface: Determine if the target environment is susceptible to Cloud Account by examining the target platforms (IaaS, SaaS, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1136.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.