Applied Cybernetics Group
T1585.003 Cloud Accounts
- Technique
T1585.003- Tactics
- Resource Development
- Research, 90 days
- 2
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1585/003
MITRE description
Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-26Arctic Wolf: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access -
2026-10-15GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew
Detection coverage
Coverage data unavailable in this snapshot (community inventory not yet ingested).