Cloud Groups
Subtechnique · ATTACK:enterprise:T1069.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1069.003",
"title": "Cloud Groups",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1069/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--16e94db9-b5b1-4cd0-b851-f38fbd0a70f2",
"external_id": "T1069.003",
"domain": "enterprise",
"created": "2020-02-21T21:15:33.222Z",
"modified": "2026-08-04T20:30:53.932Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "AWS Get Bucket ACL",
"url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html"
},
{
"source_name": "Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022",
"url": "https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/"
},
{
"source_name": "Black Hills Red Teaming MS AD Azure, 2018",
"url": "https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/"
},
{
"source_name": "Google Cloud Identity API Documentation",
"url": "https://cloud.google.com/identity/docs/reference/rest"
},
{
"source_name": "Microsoft AZ CLI",
"url": "https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest"
},
{
"source_name": "Microsoft Msolrole",
"url": "https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0"
},
{
"source_name": "GitHub Raindance",
"url": "https://github.com/True-Demon/raindance"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1069.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11f6bf91-2330-4490-831d-3c84982a2280
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:T1069.003 → subtechnique-of → ATTACK:enterprise:T1069
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--529b0bf7-66f3-47f1-893b-4daa157f7760
ATTACK:enterprise:S0684 → uses → ATTACK:enterprise:T1069.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b550a59-f036-4a4e-87f8-2125d2fe7c11
RoadtoolsATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1069.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73b54501-4907-45ec-b64a-4465a2f07a96
AADInternals DocumentationATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1069.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97115dbf-de19-4816-8c5a-5cb8b7103e8a
GitHub PacuATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1069.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f453dbd9-d26e-4e56-88eb-25d37f7aae39
Unit42KelleyVaya_BlingLibra_Aug2024