<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-api-abuse
description: >-
  Detect abuse of cloud provider APIs including credential stuffing, API key leakage,
  excessive API call rates, unauthorized cross-account access, and anomalous
  CloudTrail/Activity Log patterns indicating account compromise.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - api-abuse
  - cloudtrail
  - threat-detection
  - anomaly-detection
  - credential-abuse
  - rate-limiting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.009"]
---

# Detecting Cloud API Abuse

## Overview

Cloud API abuse occurs when attackers leverage stolen credentials, leaked API keys,
or compromised service accounts to make unauthorized API calls. Detection relies on
analyzing CloudTrail, Azure Activity Logs, and GCP Audit Logs for anomalous patterns
including unusual API calls, geographic impossibility, privilege escalation attempts,
and high-frequency reconnaissance activities. This skill provides detection queries
and automation for identifying API abuse across all three major cloud providers.

Mode: `[MODE: BLUE]` — API threat detection and monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, `gcloud` CLI configured | Required |
| AWS | CloudTrail enabled in all regions, `cloudtrail:LookupEvents` permission |
| Azure | Activity Log and Sign-in Log access |
| GCP | Admin Activity and Data Access audit logs enabled |
| Python 3.10+ with `boto3` | Required |

## Key Concepts

### AWS CloudTrail Anomaly Detection

```bash
# Find unauthorized API calls (AccessDenied)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) \
  --query 'Events[?contains(CloudTrailEvent, `Failed`)].{Time:EventTime,User:Username,Source:EventSource}'

# Detect reconnaissance — excessive Describe/List calls
aws cloudtrail lookup-events \
  --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%S) \
  --max-results 50 \
  --query 'Events[?contains(EventName, `Describe`) || contains(EventName, `List`)].{Event:EventName,User:Username,Time:EventTime}'

# Find API calls from unusual user agents
aws cloudtrail lookup-events \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) | \
  jq '.Events[].CloudTrailEvent | fromjson | select(.userAgent | test("python|boto|pacu|prowler|scout")) |
    {eventName, userAgent, sourceIPAddress, userIdentity: .userIdentity.arn}'

# Detect console login without MFA
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time $(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%S) | \
  jq '.Events[].CloudTrailEvent | fromjson |
    select(.additionalEventData.MFAUsed != "Yes") |
    {user: .userIdentity.arn, sourceIP: .sourceIPAddress, mfa: .additionalEventData.MFAUsed}'

# Find credential usage from multiple geographic locations
aws cloudtrail lookup-events \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) | \
  jq '[.Events[].CloudTrailEvent | fromjson |
    {user: .userIdentity.arn, ip: .sourceIPAddress}] |
    group_by(.user) | map(select(map(.ip) | unique | length > 3)) | .[]'
```

### Azure Activity Log Analysis

```bash
# Find failed sign-in attempts
az monitor activity-log list \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --query "[?status.value=='Failed'].{Caller:caller,Operation:operationName.value,Time:eventTimestamp}" \
  --output table

# Find high-privilege operations
az monitor activity-log list \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --query "[?contains(operationName.value,'roleAssignments/write') || contains(operationName.value,'delete')].{Caller:caller,Op:operationName.value,Time:eventTimestamp}" \
  --output table

# Query sign-in logs for risky sign-ins
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=riskLevelDuringSignIn eq 'high'" \
  --query "value[].{User:userPrincipalName,IP:ipAddress,Risk:riskLevelDuringSignIn,App:appDisplayName}"
```

### GCP Audit Log Analysis

```bash
# Find admin activity anomalies
gcloud logging read 'logName:"activity" AND severity>=WARNING' \
  --limit=50 --format=json --freshness=1d

# Detect IAM policy changes
gcloud logging read 'protoPayload.methodName="SetIamPolicy"' \
  --limit=50 --format="table(timestamp,protoPayload.authenticationInfo.principalEmail,resource.type)"

# Find service account key creation events
gcloud logging read 'protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"' \
  --limit=50 --format=json

# Detect API calls from unusual IPs
gcloud logging read 'protoPayload.requestMetadata.callerIp!~"^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\."' \
  --limit=50 --format="table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.requestMetadata.callerIp)"
```

## Workflow

### Step 1: Verify Audit Logging Coverage

```bash
# AWS — verify CloudTrail is multi-region
aws cloudtrail describe-trails --query 'trailList[].{Name:Name,MultiRegion:IsMultiRegionTrail,Logging:HasInsightSelectors}'
```

### Step 2: Run Automated Detection

```bash
node scripts/agent.js --provider aws --hours 24 --output /tmp/api_abuse.json
```

## Detection

```yaml
title: Cloud Api Abuse Detection
id: 35cfea24-b74a-4f3a-91a7-92d178b4d32d
status: experimental
description: Detects suspicious activity related to detecting cloud api abuse techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1059.009
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Api Abuse Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1059.009 |

## Verification

- [ ] CloudTrail/Activity Log/Audit Logs enabled in all regions
- [ ] Anomaly detection rules deployed for failed API calls
- [ ] Geographic impossibility detection configured
- [ ] High-privilege API calls trigger real-time alerts
- [ ] API call rate baselines established per principal
- [ ] Reconnaissance patterns (Describe/List bursts) detected
- [ ] Console logins without MFA generate alerts

## References

- [MITRE ATT&CK T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/)
- [MITRE ATT&CK T1580 — Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580/)
- [AWS CloudTrail Log Analysis](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/)
- [GCP Audit Logging](https://cloud.google.com/logging/docs/audit)
