T1098.003 Additional Cloud Roles

Technique: T1098.003
Tactics: Persistence, Privilege Escalation
Research, 90 days: 3
KEV CVEs mapped: 0
SigmaHQ rules: 7
Elastic, Splunk: 61
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1098/003

MITRE description

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)(Citation: Microsoft O365 Admin Roles) This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts. For example, in AWS environments, an adversary with appropriate permissions may be able to use the <code>CreatePolicyVersion</code> API to define a new version of an IAM policy or the <code>AttachUserPolicy</code> API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation) In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-26 Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack
2026-10-21 Microsoft Threat Intelligence: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
2026-10-16 Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Detection coverage

SigmaHQ community rules

Github Outside Collaborator Detected (core)
Granting Of Permissions To An Account (core)
User Added to an Administrator's Azure AD Role (core)
App Granted Privileged Delegated Or App Permissions (core)
App Assigned To Azure RBAC/Microsoft Entra Role (core)
Google Workspace Application Access Level Modified (core)
Okta Admin Role Assigned to an User or Group (core)

Elastic and Splunk rules

Anthropic Admin Role Assigned to User (elastic)
Anthropic Sensitive Claude Project Role Assigned to User (elastic)
Anthropic Primary Owner Transferred (elastic)
AWS IAM User Addition to Group (elastic)
AWS IAM Roles Anywhere Profile Creation (elastic)
AWS IAM Roles Anywhere Trust Anchor Created with External CA (elastic)
AWS SES Full Access Policy Attached to IAM Entity by Unusual User (elastic)
AWS Organizations Delegated Administrator Registered (elastic)
AWS Sensitive IAM Operations Performed via CloudShell (elastic)
AWS IAM AdministratorAccess Policy Attached to Group (elastic)
AWS IAM AdministratorAccess Policy Attached to Role (elastic)
AWS IAM AdministratorAccess Policy Attached to User (elastic)
AWS IAM Inline Policy Added to a Group (elastic)
AWS IAM Assume Role Policy Update (elastic)
AWS STS AssumeRoot by Rare User and Member Account (elastic)
Entra ID Global Administrator Role Assigned (elastic)
Entra ID Global Administrator Role Assigned (PIM User) (elastic)
Entra ID Privileged Identity Management (PIM) Role Modified (elastic)
Azure Event Hub Authorization Rule Created or Updated (elastic)
Azure RBAC Built-In Administrator Roles Assigned (elastic)
Entra ID Application Self-Assigned to Privileged Role (elastic)
Entra ID Elevated Access to User Access Administrator (elastic)
Entra ID Privileged Role Assigned to Another Account (elastic)
GCP Storage Bucket Permissions Modification (elastic)
GCP IAM Custom Role Creation (elastic)

Showing 25 of 61.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.