Valid cloud accounts

Info

ID: MS-TA7008
Tactic: Initial Access, Persistence
MITRE technique: T1078.004

Adversaries may gain access to cloud web applications and serverless environments by leveraging compromised valid cloud accounts. Using legitimate credentials allows attackers to interact with such services without raising suspicion. This enables them to deploy or modify application code, configure triggers, and maintain control over workloads.

For example, if an attacker gains control over an Entra ID user with owner permissions over a subscription, they would be able to read and modify any function that reside in the subscription.

Mitigations

ID	Mitigation	Description
MS-M7012	Enforce multi-factor authentication (MFA)	Require MFA for all user and administrative accounts to prevent unauthorized access from stolen credentials.
MS-M7017	Implement least-privilege access	Grant users and service accounts only the minimum permissions required for their role.
MS-M7018	Use conditional access policies	Restrict account access based on contextual factors such as IP address, device compliance, risk level, or time of day.