Threadlinqs IntelligenceStart free

ATT&CK techniqueExecution

T1651 Cloud Administration Command

ExecutionEnterprise

As of 2026-11-04, T1651 (Cloud Administration Command) appears in 10 tracked threats, first reported 2026-05-19 and most recently 2026-11-03, with linked actors including VAPOR PANDA, TeamPCP; it most often appears alongside T1526 (Cloud Service Discovery).

Tracked threats
103 critical, 6 high, 1 medium
First seen
2026-05-19
Last seen
2026-11-03
Threat actors
2In the threats using it
Detection rules
8Unlock with TL Creds

Data as of:

Activity timeline

T1651 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.

How adversaries use it

T1651 Cloud Administration Command is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix. Threadlinqs maps 10 of 3581 tracked threats (0.3%) to it; by severity that is 3 critical, 6 high, 1 medium.

Threats that use T1651 most often also use T1526 Cloud Service Discovery (7 threats), T1078 Valid Accounts (6 threats), T1528 Steal Application Access Token (6 threats), T1580 Cloud Infrastructure Discovery (6 threats), T1530 Data from Cloud Storage (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

2 tracked threat actors appear in the threats that use T1651; the most frequent are VAPOR PANDA (2), TeamPCP (1).

Threat actors using it

Tracked threats

10 tracked threats use T1651.

Detection coverage

Threadlinqs maintains 8 detection rules mapped to T1651 (SPL 2, KQL 2, Sigma 4). Rule content unlocks with TL Creds on a free account; this page shows counts only.

8 detection rules (SPL/KQL/Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)