{"id":"T1059.009","name":"Cloud API","url":"https://attack.mitre.org/techniques/T1059/009","tactics":["execution"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0078","stix_id":"x-mitre-detection-strategy--e7bd0f37-f2cf-4e3c-a9c1-c41f63b67e1c","name":"Behavioral Detection of Malicious Cloud API Scripting","url":"https://attack.mitre.org/detectionstrategies/DET0078","analytics":[{"id":"AN0215","stix_id":"x-mitre-analytic--fb933fd5-5dd8-4879-b2bb-e68bc26ff60d","name":"Analytic 0215","description":"Detects adversarial use of cloud APIs for command execution, resource control, or reconnaissance. Focuses on CLI/SDK/scripting language abuse via stolen credentials or in-browser Cloud Shells. Monitors for anomalous API calls chained with authentication context shifts (e.g., stolen token -> privileged action) and cross-service impacts.","url":"https://attack.mitre.org/detectionstrategies/DET0078#AN0215","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"aws-cloudtrail"},{"name":"azure:activity","channel":"operationName: Write, Access Review, RoleAssignment","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"azure-activity"},{"name":"Okta:SystemLog","channel":"eventType: user.authentication.sso, app.oauth2.token.grant","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"okta-systemlog"}],"mutable_elements":[{"field":"TimeWindow","description":"Off-hours API usage or configuration changes are more suspicious outside business context."},{"field":"UserAgent","description":"Unexpected SDK usage (e.g., `boto3`, `azcopy`, unknown User-Agent strings)."},{"field":"CredentialType","description":"High-risk if access token or API key used outside expected geographic/IP behavior."},{"field":"APISequence","description":"Unusual or rapid chaining of provisioning, IAM, and execution APIs."},{"field":"ConsoleContext","description":"Browser-based Cloud Shell vs local CLI may indicate insider vs external use case."}],"live":true,"detection_strategies":["DET0078"],"techniques":["T1059.009"]}],"live":true,"version":"1.0","techniques":["T1059.009"]}],"sigma_rules":[{"id":"db014773-7375-4f4e-b83b-133337c0ffee","title":"AWS IAM S3Browser Templated S3 Bucket Policy Creation","author":"daniel.bohannon@permiso.io (@danielhbohannon)","status":"test","level":"high","date":"2023-05-17","modified":null,"description":"Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of \"<YOUR-BUCKET-NAME>\".","references":["https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.execution","attack.stealth","attack.t1059.009","attack.persistence","attack.initial-access","attack.privilege-escalation","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml","techniques":["T1059.009","T1078.004"],"cves":[]},{"id":"db014773-b1d3-46bd-ba26-133337c0ffee","title":"AWS IAM S3Browser LoginProfile Creation","author":"daniel.bohannon@permiso.io (@danielhbohannon)","status":"test","level":"high","date":"2023-05-17","modified":null,"description":"Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.","references":["https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.execution","attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1059.009","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml","techniques":["T1059.009","T1078.004"],"cves":[]},{"id":"db014773-d9d9-4792-91e5-133337c0ffee","title":"AWS IAM S3Browser User or AccessKey Creation","author":"daniel.bohannon@permiso.io (@danielhbohannon)","status":"test","level":"high","date":"2023-05-17","modified":null,"description":"Detects S3 Browser utility creating IAM User or AccessKey.","references":["https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.initial-access","attack.stealth","attack.t1059.009","attack.t1078.004"],"path":"rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml","techniques":["T1059.009","T1078.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}