Cloud Security & Attack

When to Activate

• Cloud penetration test / red team against AWS, Azure (Entra ID), or GCP
• IAM / identity privilege escalation and cross-account or cross-tenant pivoting
• Compromised web app or SSRF reachable from cloud compute — harvest metadata credentials
• Kubernetes / container assessment, node breakout, cluster takeover
• CI/CD and IaC review: Terraform state, OIDC federation trust policies, pipeline secrets
• Post-exploitation: secret extraction, lateral movement, persistence in cloud control plane

Technique Map

Technique	ATT&CK	CWE	Reference	Script
AWS IAM privesc (CreatePolicyVersion, PassRole, AttachPolicy)	T1098.001	CWE-269	references/aws-iam-privesc.md	scripts/aws_privesc_enum.py
AWS sts:AssumeRoot member-account escalation	T1078.004	CWE-269	references/aws-iam-privesc.md	scripts/aws_privesc_enum.py
Cross-account confused deputy / missing ExternalId	T1078.004	CWE-441	references/aws-iam-privesc.md	scripts/oidc_trust_auditor.py
IMDS / metadata SSRF credential theft (AWS/Azure/GCP)	T1552.005	CWE-918	references/imds-metadata-ssrf.md	scripts/imds_harvester.py
EKS node creds → IRSA / Pod Identity pivot	T1552.007	CWE-668	references/imds-metadata-ssrf.md	scripts/imds_harvester.py
Entra device-code phishing → PRT / device join	T1528	CWE-287	references/azure-entra-attacks.md	scripts/entra_device_code_phish.py
FOCI refresh-token family abuse	T1550.001	CWE-613	references/azure-entra-attacks.md	scripts/entra_device_code_phish.py
Azure Managed Identity / App-Admin → SP escalation	T1098.001	CWE-269	references/azure-entra-attacks.md	scripts/imds_harvester.py
GCP actAs + resource create impersonation chain	T1078.004	CWE-269	references/gcp-attacks.md	scripts/gcp_impersonation_mapper.py
GCP serviceAccountTokenCreator token chains	T1528	CWE-269	references/gcp-attacks.md	scripts/gcp_impersonation_mapper.py
Vertex AI P4SA / Ray head-node escalation	T1078.004	CWE-732	references/gcp-attacks.md	scripts/gcp_impersonation_mapper.py
Container escape (runc Leaky Vessels CVE-2024-21626)	T1611	CWE-668	references/kubernetes-container-escape.md	-
IngressNightmare (CVE-2025-1974) cluster takeover	T1190	CWE-94	references/kubernetes-container-escape.md	scripts/k8s_can_i_abuse.py
K8s RBAC privesc (pods/exec, token mount, node proxy)	T1078	CWE-269	references/kubernetes-container-escape.md	scripts/k8s_can_i_abuse.py
Terraform state secret extraction	T1552.001	CWE-312	references/iac-secrets-ci-cd.md	scripts/oidc_trust_auditor.py
OIDC federation trust-policy abuse (GitHub/TF Cloud)	T1199	CWE-441	references/iac-secrets-ci-cd.md	scripts/oidc_trust_auditor.py

Quick Start

# --- 0. Identify where you are ---
aws sts get-caller-identity                       # AWS
az account show && az ad signed-in-user show      # Azure
gcloud auth list && gcloud config get-value project  # GCP

# --- 1. AWS: enumerate then map privesc paths ---
python3 scripts/aws_privesc_enum.py --profile compromised --json paths.json
cloudfox aws --profile compromised all-checks      # alt: broad inventory
pacu  # > run iam__enum_permissions ; run iam__privesc_scan

# --- 2. SSRF / metadata: harvest creds from a reachable compute target ---
python3 scripts/imds_harvester.py --ssrf "https://app/fetch?url=" --provider aws
python3 scripts/imds_harvester.py --local --provider azure --resource https://vault.azure.net/

# --- 3. Azure Entra: device-code phish for tokens (authorized phishing only) ---
python3 scripts/entra_device_code_phish.py --resource https://graph.microsoft.com \
    --client-id 29d9ed98-a469-4536-ade2-f981bc1d605e   # Auth Broker -> PRT path

# --- 4. GCP: build the service-account impersonation graph ---
python3 scripts/gcp_impersonation_mapper.py --project TARGET --out gcp_graph.json

# --- 5. Kubernetes: what can this token do, and can we break out? ---
python3 scripts/k8s_can_i_abuse.py --kubeconfig ./kubeconfig
kubectl auth can-i --list ; peirates

# --- 6. CI/CD + IaC: audit federation trust + dump state secrets ---
python3 scripts/oidc_trust_auditor.py --profile compromised
aws s3 cp s3://tf-state/prod/terraform.tfstate - | jq '.. | .password? // empty'

OPSEC & Detection (summary)

Technique	Telemetry / IOC	Detection (Sigma / EDR / cloud)	OPSEC note
IAM privesc API calls	CloudTrail CreatePolicyVersion, AttachUserPolicy, CreateLoginProfile	Alert on IAM write by non-IAM-admin principal; GuardDuty PrivilegeEscalation:IAMUser/*	Use existing admin sessions; avoid bulk enum that trips anomaly detection
sts:AssumeRoot	CloudTrail AssumeRoot (regional only)	Elastic "AssumeRoot by Rare User and Member Account" (new-terms rule)	Rare-event detection fires on first use per (principal, member account)
IMDS SSRF	VPC flow to 169.254.169.254 from web tier; STS use from new ASN	GuardDuty UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration* (creds used off-instance)	Use creds from same egress IP where possible; creds expire — refresh fast
Entra device-code phish	Sign-in logs authenticationProtocol=deviceCode; Auth Broker client 29d9ed98-...; new device registration	Sentinel device-code anomaly; CA "block device code flow"	Tokens valid even after password reset; device-join = MFA-resistant persistence
GCP impersonation	GenerateAccessToken / generateAccessToken in Admin Activity + Data Access logs	Alert on impersonation by principal lacking a documented chain	Requires Data Access (DATA_READ) audit logs enabled to see token minting
Container escape (runc)	New process from /proc/self/fd/* cwd; host binary writes; nsenter in container	Falco Container escape/Drop and execute new binary; runc ≤1.1.11 inventory	Overwrites host runc → noisy; prefer read-only host FS read for stealth
IngressNightmare	NGINX ingress pod loads .so from /proc; outbound from controller	Falco/Sysdig "IngressNightmare" shared-lib load; ingress-nginx < 1.11.5/1.12.1	Exploit hits admission webhook (often internal-only) — low external noise
OIDC trust abuse	CloudTrail AssumeRoleWithWebIdentity from unexpected sub/repo	Alert on web-identity assume with mismatched aud/sub; RCP block	Wildcard sub (org:foo*) still exploitable; no creds needed

Deep Dives

• references/aws-iam-privesc.md — Classic + 2024 IAM escalation chains, sts:AssumeRoot, cross-account confused deputy / ExternalId, Cognito, secrets harvesting; detection per API.
• references/imds-metadata-ssrf.md — IMDSv1/v2 mechanics, SSRF bypasses, Azure & GCP metadata token theft, EKS node-cred → IRSA/Pod Identity lateral movement.
• references/azure-entra-attacks.md — Storm-2372 device-code → PRT → device-join chain, FOCI token families, Managed Identity abuse, Application Administrator → service principal → Global Admin.
• references/gcp-attacks.md — actAs + resource-create impersonation, serviceAccountTokenCreator chains, Cloud Functions takeover, Vertex AI ModeLeak/P4SA/Ray escalation.
• references/kubernetes-container-escape.md — runc Leaky Vessels (CVE-2024-21626), privileged/hostPID/Docker-socket escapes, IngressNightmare (CVE-2025-1974), RBAC primitives, kubelet/etcd.
• references/iac-secrets-ci-cd.md — Terraform state secret extraction, OIDC federation trust-policy abuse (GitHub Actions / Terraform Cloud), pipeline secret theft, RCP/SCP defenses.