Procedure examples

HAFNIUM has abused service principals in compromised environments to enable data exfiltration.

Scattered Spider has used compromised Microsoft Entra ID accounts to pivot in victim environments.

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.

Storm-0501 has leveraged compromised accounts to access Microsoft Entra Connect, which was used to synchronize on-premises identities and Microsoft Entra identities, allowing users to sign into both environments with the same password. Storm-0501 has also used the victim Global Administrator account that lacked any registered MFA method to access victim cloud environments. Storm-0501 has leveraged Storage Account Access Keys within the victim environment.

APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.

APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.

APT5 has accessed Microsoft M365 cloud environments using stolen credentials.

LAPSUS$ has used compromised credentials to access cloud assets within a target organization.

VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.

APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.

TeamPCP has used compromised credentials for GitHub and software package repositories, including privileged service accounts, to inject malicious code into CI/CD pipelines.

ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments. Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.