Establish Accounts: Cloud Accounts (T1585.003) is a resource development technique tagged PRE. The adversary creates accounts with cloud providers to use later in an operation.
You will not see the sign-up. You may see the traffic.
How attackers use it
MITRE says adversaries can use cloud accounts to support operations, including cloud storage services such as Dropbox, MEGA, Microsoft OneDrive or AWS S3 buckets. Storage can be used for exfiltration to cloud storage or to upload tools.
Cloud accounts can also be used to acquire infrastructure, such as virtual private servers or serverless infrastructure. MITRE adds that establishing cloud accounts may let adversaries develop sophisticated capabilities without managing their own servers. Creating a cloud account may itself need an email account to register with the provider.
How to detect it
MITRE says that much of the activity is outside the visibility of the target organization. It points detection efforts toward the related stage of exfiltration, for example transferring data to a cloud account.
What that looks like on your network, as general practice:
- Large or unusual uploads to consumer cloud storage domains.
- Uploads from servers and from accounts that do not normally handle outbound transfers.
- Traffic to cloud storage services that your company does not use.
- Endpoints that fetch tools or scripts from a public cloud storage link and then run them.
Data loss prevention and proxy logs with byte counts are the usual sources. The aim is to see where data goes, even when the destination is a legitimate provider.
How to reduce the risk
MITRE lists Pre-compromise as the mitigation. The adversary's accounts are not something you can prevent. The data movement into them is.
- Allow only the cloud storage services you use, and block or alert on the rest for sensitive systems.
- Use tenant restrictions where a provider offers them, so that corporate devices sign in only to your tenant.
- Restrict outbound access from servers to what they need.
- Make sure sensitive data stores are labeled and monitored.
A small step with a good return is to list the outbound destinations for cloud storage used by your servers and compare it with the services the business actually pays for. Anything left over is a question to ask. Often the answer is a forgotten integration, and occasionally it is something worth investigating.
Check your own environment
- From proxy logs, list the cloud storage domains reached by your servers in the last 30 days.
- Compare the list with the services your business actually uses.
- Check whether uploads are logged with account name and bytes.
- Linux, read-only:
ss -tpn state establishedshows which processes hold outbound connections right now.
Quick check
What follow-on stage does MITRE suggest watching for T1585.003?
Exfiltration, such as transferring data to a cloud account.
Why might an adversary need an email account for this technique?
Creating a cloud account may need an email address to register with the provider.
