Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.

IaaS environments often group resources into a hierarchy, enabling improved resource management and application of policies to relevant groups. Hierarchical structures differ among cloud providers. For example, in AWS environments, multiple accounts can be grouped under a single organization, while in Azure environments, multiple subscriptions can be grouped under a single management group.^[1],[2]

Adversaries may add, delete, or otherwise modify resource groups within an IaaS hierarchy. For example, in Azure environments, an adversary who has gained access to a Global Administrator account may create new subscriptions in which to deploy resources. They may also engage in subscription hijacking by transferring an existing pay-as-you-go subscription from a victim tenant to an adversary-controlled tenant. This will allow the adversary to use the victim’s compute resources without generating logs on the victim tenant.^[3],[4]

In AWS environments, adversaries with appropriate permissions in a given account may call the LeaveOrganization API, causing the account to be severed from the AWS Organization to which it was tied and removing any Service Control Policies, guardrails, or restrictions imposed upon it by its former Organization. Alternatively, adversaries may call the CreateAccount API in order to create a new account within an AWS Organization. This account will use the same payment methods registered to the payment account but may not be subject to existing detections or Service Control Policies.^[5]

References

1. AWS. (n.d.). Terminology and concepts for AWS Organizations. Retrieved September 25, 2024.
2. Microsoft Azure. (2024, May 31). Organize your Azure resources effectively. Retrieved September 25, 2024.
3. Microsoft Threat Intelligence. (2023, September 14). Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets. Retrieved September 18, 2023.
4. Dor Edry. (2022, August 24). Hunt for compromised Azure subscriptions using Microsoft Defender for Cloud Apps. Retrieved September 5, 2023.
5. AWS re Inforce. (2024, June). Retrieved April 15, 2026.

Tickets liés

• MITREATTACK -

  EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

  DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.