Adversaries may abuse cloud APIs to execute malicious commands. Tactics TA0002 Sub-technique of T1059 See: MITRE ATT&CK