Threadlinqs IntelligenceStart free

ATT&CK techniquePersistence

T1136.003 Cloud Account

PersistenceEnterpriseSub-technique

As of 2026-10-24, T1136.003 (Cloud Account) appears in 11 tracked threats, first reported 2026-05-13 and most recently 2026-10-21; it most often appears alongside T1078.004 (Cloud Accounts).

Tracked threats
119 critical, 2 high
First seen
2026-05-13
Last seen
2026-10-21
Threat actors
—None attributed yet
Detection rules
27Blue tier and above

Data as of:

Activity timeline

T1136.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-05 with 3 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1136.003 Cloud Account is catalogued by MITRE ATT&CK under the Persistence tactic in the Enterprise matrix, as a sub-technique of T1136 Create Account. Threadlinqs maps 11 of 3185 tracked threats (0.3%) to it; by severity that is 9 critical, 2 high.

Threats that use T1136.003 most often also use T1078.004 Cloud Accounts (9 threats), T1550.001 Application Access Token (8 threats), T1098.001 Additional Cloud Credentials (7 threats), T1098.003 Additional Cloud Roles (7 threats), T1526 Cloud Service Discovery (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Mitigations

MITRE ATT&CK lists 3 mitigations for T1136.003.

Data sources

Telemetry that can reveal T1136.003, per MITRE ATT&CK.

  • User Account — User Account Creation

Tracked threats

11 tracked threats use T1136.003.

Detection coverage

Threadlinqs maintains 27 detection rules mapped to T1136.003 (SPL 9, KQL 10, Sigma 8). Rule content is available to Blue tier accounts and above; this page shows counts only.

27 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1136 Create Account — 165 tracked threats at the technique level.