<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-lateral-movement
description: >-
  Detect lateral movement in cloud environments including cross-account role
  assumption, EC2 instance credential abuse, service-to-service pivoting,
  metadata service exploitation, and Kubernetes pod-to-pod movement using
  CloudTrail analysis, VPC Flow Logs, and SIEM correlation.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - lateral-movement
  - cross-account
  - imds
  - cloudtrail
  - vpc-flow-logs
  - siem
  - threat-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021", "T1550"]
---

# Detecting Cloud Lateral Movement

## Overview

Cloud lateral movement differs from traditional networks — attackers pivot
through IAM role assumptions, stolen instance credentials, service API abuse,
and metadata service exploitation. This skill provides detection rules for
CloudTrail, VPC Flow Logs, and Kubernetes audit logs to identify cross-account
and cross-service lateral movement.

Mode: `[MODE: BLUE]` — Lateral movement detection. `[MODE: RED]` — Cloud lateral movement techniques. `[MODE: PURPLE]` — Detection engineering.

## Prerequisites

| Requirement | Details |
|---|---|
| CloudTrail with management and data events enabled | Required |
| VPC Flow Logs active | Required |
| SIEM (Splunk, Elastic, Sentinel) for correlation | Required |
| Kubernetes audit logging enabled | Required |

## Key Concepts

### CloudTrail Detection Rules

```bash
# Detect cross-account role assumption
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole \
  --output json | jq '.Events[] | {time: .EventTime, user: .Username, event: .CloudTrailEvent}' | \
  jq 'select(.event | fromjson | .requestParameters.roleArn | test("arn:aws:iam::[0-9]+:role"))'

# Detect console login from new IP
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --output json

# Detect credential use from unusual region
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=GetCallerIdentity \
  --output json
```

### Sigma Rules for Cloud Lateral Movement

```yaml
title: Cross-Account Role Assumption from EC2 Instance
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects AssumeRole calls originating from EC2 instance credentials targeting external accounts
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: AssumeRole
    userIdentity.type: AssumedRole
  filter_internal:
    requestParameters.roleArn|contains: 'ACCOUNT_ID'
  condition: selection and not filter_internal
falsepositives:
  - Cross-account automation with known role ARNs
level: high
tags:
  - attack.lateral_movement
  - attack.t1550.001

---
title: EC2 Instance Metadata Service Token Theft
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects API calls using EC2 instance credentials from outside the expected VPC
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userIdentity.type: AssumedRole
    userIdentity.arn|contains: ':assumed-role/aws:ec2-infrastructure'
  filter_expected_ip:
    sourceIPAddress|cidr: '10.0.0.0/8'
  condition: selection and not filter_expected_ip
falsepositives:
  - NAT gateway egress from expected VPCs
level: critical
tags:
  - attack.credential_access
  - attack.t1552.005
```

### Kubernetes Lateral Movement Detection

```bash
# Detect pod exec across namespaces
kubectl get events -A --field-selector reason=ExecCreate -o json

# Audit logs for cross-namespace service account use
# Query K8s audit logs for token requests
cat audit.log | jq 'select(.verb == "create" and .objectRef.resource == "serviceaccounts/token")'

# Network policy violations (if using Calico/Cilium)
kubectl logs -n kube-system -l k8s-app=calico-node --tail=100 | grep -i denied
```

### VPC Flow Log Analysis

```bash
# Query VPC Flow Logs for unusual internal traffic
# CloudWatch Insights query
# fields @timestamp, srcAddr, dstAddr, dstPort, action
# | filter action = "ACCEPT" and dstPort in [22, 3389, 5985]
# | stats count(*) by srcAddr, dstAddr, dstPort
# | sort count desc

aws logs start-query \
  --log-group-name vpc-flow-logs \
  --start-time $(date -d '1 hour ago' +%s) --end-time $(date +%s) \
  --query-string 'fields @timestamp, srcAddr, dstAddr, dstPort | filter dstPort in [22, 3389, 5985] | stats count(*) by srcAddr, dstAddr'
```

### IMDS Exploitation Detection

```bash
# Detect IMDSv1 usage (should be disabled)
aws ec2 describe-instances --output json | \
  jq '.Reservations[].Instances[] | select(.MetadataOptions.HttpTokens != "required") | {InstanceId, HttpTokens: .MetadataOptions.HttpTokens}'

# Enforce IMDSv2
aws ec2 modify-instance-metadata-options --instance-id INSTANCE_ID \
  --http-tokens required --http-put-response-hop-limit 1
```

## Workflow

```bash
node scripts/agent.js --action detect --provider aws --output /tmp/lateral-movement.json
cat /tmp/lateral-movement.json | jq '.findings[]'
```

## Verification

- [ ] Cross-account AssumeRole monitored and alerted
- [ ] EC2 instance credential usage from unexpected IPs detected
- [ ] IMDSv2 enforced on all EC2 instances
- [ ] K8s pod exec events logged and alerted
- [ ] VPC Flow Logs analyzed for internal port scanning
- [ ] SIEM correlation rules active for lateral movement patterns

## References

- [MITRE ATT&CK Cloud — Lateral Movement](https://attack.mitre.org/tactics/TA0008/)
- [AWS CloudTrail Event Reference](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference.html)
- [Detecting Cloud Lateral Movement — Datadog](https://www.datadoghq.com/blog/cloud-lateral-movement/)
