[Feature Request] Add Python module for detecting T1098.003 - Additional Cloud Roles
- Dominant language
- Python
- Stars
- 170
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
## 🐍 Python Module for MITRE ATT&CK Technique Detection
**Technique Name:** Account Manipulation: Additional Cloud Roles
**Technique ID:** T1098.003
**Technique Description:** An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.
### Describe the solution you'd like
With authentication from compromised credentials, create a new group or role within Google Workspace. Then create a new user and add the user to this new group or role. As an option from the config, it should be possible to add a default admin role as well which would be a good signal for privilege escalation.
### Additional context
```
Requirements:
- Google Admin API
- Python packages (google-auth google-auth-oauthlib google-auth-httplib2 google-api-python-client, email, base64)
- Scopes: https://www.googleapis.com/auth/admin.directory.group and https://www.googleapis.com/auth/admin.directory.user
Module Workflow:
Step 1: What is the group or role to create? Enter a group or role:
Step 2: What is the user to be created? Enter your user email:
Step 3: Create group or role
Step 4: Create the user account
Step 5: Assign the group or role to the user account
Module Actions:
1. Authenticate
2. Create group or role
3. Create user account
4. Add user to group or role
5. Cleanup: remove user from group or role
6. Cleanup: remove group or role
```
### Checklist
Please ensure the following tasks are completed before submitting your feature request:
- [x] This issue is for a specific MITRE ATT&CK technique detection
- [x] The technique name and ID are clearly specified
- [x] The problem and desired solution are clearly described
- [x] Any necessary alternatives or additional context have been provided
Contributor guide
Assessment
This issue has not been assessed yet.