Detecting Modify Cloud Resource Hierarchy (MITRE ATT&CK T1666)

Modify Cloud Resource Hierarchy (T1666) is a defense evasion technique for infrastructure-as-a-service (IaaS) environments. MITRE files it under the Defense Impairment tactic, with IaaS as the only platform.

Cloud providers group resources into a hierarchy so that policy can be applied to whole groups at once. In AWS, several accounts sit under one organization. In Azure, several subscriptions sit under a management group. This technique is about tampering with that structure so that the policies, logs and detections attached to it stop applying.

How attackers use it

MITRE explains that adversaries may add, delete or otherwise modify resource groups within the hierarchy. It gives concrete cases for each provider.

Azure. An adversary who has gained access to a Global Administrator account may create new subscriptions in which to deploy resources. They may also hijack a subscription by transferring an existing pay-as-you-go subscription from a victim tenant to a tenant the adversary controls. MITRE notes this lets the adversary use the victim's compute resources without generating logs on the victim tenant.

AWS. An adversary with the right permissions in an account may call the LeaveOrganization API. That severs the account from its AWS Organization and removes any Service Control Policies, guardrails or restrictions the organization imposed. Alternatively, the adversary may call CreateAccount to make a new account inside the organization. The new account uses the same payment methods registered to the payment account, but may not be covered by existing detections or Service Control Policies.

The common effect is a place to operate that your central controls do not reach, often paid for by you.

How to detect it

MITRE's detection strategy centers on unusual changes to the hierarchy and on correlation with privilege changes:

• Watch for anomalous calls to APIs such as LeaveOrganization, CreateAccount and MoveAccount.
• Watch for Azure subscription transfers and unexpected creation of new subscriptions.
• Correlate the account performing the change with administrative role assignments, tenant transfers and other activity that departs from your normal baseline.
• Look for a sequence: a role elevation followed by a hierarchy modification within a short time window.

Practically, that means these control plane logs need to be collected centrally: AWS CloudTrail from the management account, and the Azure activity log and Entra ID audit logs. A change in the hierarchy is rare in most organizations, which makes it a good candidate for a high-priority alert.

How to reduce the risk

MITRE lists three mitigations.

1. Software Configuration. In Azure, consider setting a policy that blocks subscription transfers. In AWS, consider using Service Control Policies to prevent use of the LeaveOrganization API call.
2. User Account Management. Limit permissions to add, delete or modify resource groups to only those required.
3. Audit. Periodically audit resource groups in the cloud management console so that only expected items exist, especially near the top of the hierarchy such as AWS accounts and Azure subscriptions. MITRE adds that top-level accounts, such as the AWS management account, should not contain workloads or resources.

The theme is to protect the top of the tree. Anyone who can reshape it can step out of every rule below it.

Check your own environment

These are read-only checks. Run them with an identity that has the right to read organization data.

AWS CLI, from the management account:

aws organizations describe-organization
aws organizations list-accounts
aws organizations list-policies --filter SERVICE_CONTROL_POLICY

Azure CLI:

az account list --output table
az account management-group list --output table

Then work through this list:

• Compare the account and subscription list with what finance and engineering expect. Is anything unfamiliar?
• Confirm that the management account runs no workloads.
• Check that a Service Control Policy denies LeaveOrganization for member accounts.
• Check whether your Azure tenant blocks subscription transfers.
• Review who holds Global Administrator or equivalent organization-level roles.
• Confirm that alerts exist for LeaveOrganization, CreateAccount and MoveAccount.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MITRE ATT&CK, Modify Cloud Resource Hierarchy (T1666): https://attack.mitre.org/techniques/T1666