Esc
Cloud API - T1059.009
(ATT&CK® Technique)
Definition
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1059009["Cloud API"] --> |executes| ExecutableScript["Executable Script"]; class T1059009 OffensiveTechniqueNode; class ExecutableScript ArtifactNode; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript"; click T1059009 href "/offensive-technique/attack/T1059.009/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";DecoyFile["Decoy File"] --> | spoofs | ExecutableScript["Executable Script"]; DecoyFile["Decoy File"] -.-> | may-deceive | T1059009["Cloud API"] ; class DecoyFile DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click DecoyFile href "/technique/d3f:DecoyFile"; DynamicAnalysis["Dynamic Analysis"] --> | analyzes | ExecutableScript["Executable Script"]; DynamicAnalysis["Dynamic Analysis"] -.-> | may-detect | T1059009["Cloud API"] ; class DynamicAnalysis DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click DynamicAnalysis href "/technique/d3f:DynamicAnalysis"; EmulatedFileAnalysis["Emulated File Analysis"] --> | analyzes | ExecutableScript["Executable Script"]; EmulatedFileAnalysis["Emulated File Analysis"] -.-> | may-detect | T1059009["Cloud API"] ; class EmulatedFileAnalysis DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click EmulatedFileAnalysis href "/technique/d3f:EmulatedFileAnalysis"; FileIntegrityMonitoring["File Integrity Monitoring"] --> | analyzes | ExecutableScript["Executable Script"]; FileIntegrityMonitoring["File Integrity Monitoring"] -.-> | may-detect | T1059009["Cloud API"] ; class FileIntegrityMonitoring DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; FileEviction["File Eviction"] --> | deletes | ExecutableScript["Executable Script"]; FileEviction["File Eviction"] -.-> | may-evict | T1059009["Cloud API"] ; class FileEviction DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click FileEviction href "/technique/d3f:FileEviction"; FileEncryption["File Encryption"] --> | encrypts | ExecutableScript["Executable Script"]; FileEncryption["File Encryption"] -.-> | may-harden | T1059009["Cloud API"] ; class FileEncryption DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click FileEncryption href "/technique/d3f:FileEncryption"; ExecutableAllowlisting["Executable Allowlisting"] --> | blocks | ExecutableScript["Executable Script"]; ExecutableAllowlisting["Executable Allowlisting"] -.-> | may-isolate | T1059009["Cloud API"] ; class ExecutableAllowlisting DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click ExecutableAllowlisting href "/technique/d3f:ExecutableAllowlisting"; ExecutableDenylisting["Executable Denylisting"] --> | blocks | ExecutableScript["Executable Script"]; ExecutableDenylisting["Executable Denylisting"] -.-> | may-isolate | T1059009["Cloud API"] ; class ExecutableDenylisting DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click ExecutableDenylisting href "/technique/d3f:ExecutableDenylisting"; LocalFilePermissions["Local File Permissions"] --> | restricts | ExecutableScript["Executable Script"]; LocalFilePermissions["Local File Permissions"] -.-> | may-isolate | T1059009["Cloud API"] ; class LocalFilePermissions DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; RestoreFile["Restore File"] --> | restores | ExecutableScript["Executable Script"]; RestoreFile["Restore File"] -.-> | may-restore | T1059009["Cloud API"] ; class RestoreFile DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click RestoreFile href "/technique/d3f:RestoreFile"; FileAnalysis["File Analysis"] --> | analyzes | ExecutableScript["Executable Script"]; FileAnalysis["File Analysis"] -.-> | may-detect | T1059009["Cloud API"] ; class FileAnalysis DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click FileAnalysis href "/technique/d3f:FileAnalysis"; RemoteFileAccessMediation["Remote File Access Mediation"] --> | isolates | ExecutableScript["Executable Script"]; RemoteFileAccessMediation["Remote File Access Mediation"] -.-> | may-isolate | T1059009["Cloud API"] ; class RemoteFileAccessMediation DefensiveTechniqueNode; class ExecutableScript ArtifactNode; click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";