Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)

In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the <code>CreateKeyPair</code> or <code>ImportKeyPair</code> API in AWS or the <code>gcloud compute os-login ssh-keys add</code> command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)

Adversaries may also use the <code>CreateAccessKey</code> API in AWS or the <code>gcloud iam service-accounts keys create</code> command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) 

In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence)
Additional Cloud Credentials
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1098/001  external_id: T1098.001     source_name: Crowdstrike AWS User Federation Persistence  description:  Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.  url: https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/     source_name: Expel IO Evil in AWS  description: A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.  url: https://expel.io/blog/finding-evil-in-aws/     source_name: SpecterOps Azure Privilege Escalation  description: Andy Robbins. (2021, October 12). Azure Privilege Escalation via Service Principal Abuse. Retrieved April 1, 2022.  url: https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5     source_name: Demystifying Azure AD Service Principals  description: Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.  url: https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/     source_name: GCP SSH Key Add  description: Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.  url: https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add     source_name: Blue Cloud of Death Video  description: Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.  url: https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815     source_name: Blue Cloud of Death  description: Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.  url: https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1     source_name: Microsoft SolarWinds Customer Guidance  description: MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.  url: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/     source_name: Expel Behind the Scenes  description: S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.  url: https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/     source_name: Sysdig ScarletEel 2.0  description: SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. (2023, July 11). SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. Retrieved July 12, 2023.  url: https://sysdig.com/blog/scarleteel-2-0/     source_name: Rhino Security Labs AWS Privilege Escalation  description: Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.  url: https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/     