<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-attack-simulation
description: >-
  Simulate cloud-native attack paths across AWS, Azure, and GCP environments
  including privilege escalation, lateral movement between services, storage
  exfiltration, and identity federation abuse to validate cloud security posture.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - cloud-security
  - aws-attack
  - azure-attack
  - gcp-attack
  - cloud-pentesting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004", "T1530", "T1537", "T1580", "T1619"]
  frameworks: ["MITRE ATT&CK Cloud", "CIS Benchmarks", "CSA CCM"]
  tools: ["python3", "pacu", "cloudfox", "prowler"]
---

# Performing Cloud Attack Simulation

## Overview

Cloud attack simulation replicates adversary techniques targeting cloud
infrastructure — from initial access via stolen credentials or SSRF to
privilege escalation through IAM misconfigurations, lateral movement across
services, and data exfiltration from storage buckets. These simulations
validate cloud security posture management, IAM least privilege, and cloud
detection and response capabilities.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `Pacu` | Security tooling |
| `CloudFox` | Security tooling |
| `Prowler` | Security tooling |
| `cloud provider CLIs` | Security tooling |
| Authorized cloud assessment scope with account/subscription boundaries | Environment requirement |
| Dedicated test credentials with defined starting permissions | Environment requirement |
| Cloud-native SIEM or detection stack for alert correlation | Environment requirement |

## Workflow

### Step 1: Cloud Reconnaissance

```bash
# Enumerate cloud resources and permissions from initial access
node scripts/agent.js enumerate --provider aws --profile test-role

# Map IAM privilege escalation paths
node scripts/agent.js privesc-paths --provider aws --principal arn:aws:iam::123:role/test
```

### Step 2: Simulate Privilege Escalation

```bash
# Test IAM privilege escalation techniques
node scripts/agent.js escalate --provider aws --technique iam-passrole

# Enumerate cross-account trust relationships
node scripts/agent.js cross-account --provider aws
```

### Step 3: Lateral Movement and Exfiltration

```bash
# Simulate lateral movement between cloud services
node scripts/agent.js lateral --provider aws --source lambda --target ec2

# Test storage exfiltration paths
node scripts/agent.js exfil-test --provider aws --bucket target-data --dry-run
```

### Step 4: Generate Cloud Security Report

```bash
# Produce cloud attack simulation report
node scripts/agent.js report --provider aws --output cloud-report.json
```

## Detection

```yaml
title: Cloud Attack Simulation Detection
id: b5f28c54-c23e-41f1-8490-ba5ace49bbd9
status: experimental
description: Detects suspicious activity related to performing cloud attack simulation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*cloud*"
  condition: selection
level: high
tags:
  - attack.t1078.004
  - attack.t1530
  - attack.t1537
  - attack.t1580
  - attack.t1619
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Attack Simulation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004, T1530, T1537, T1580, T1619 |

## Verification

- [ ] Cloud resources enumerated within authorized scope
- [ ] IAM privilege escalation paths identified and tested
- [ ] Lateral movement between services documented
- [ ] Storage exfiltration controls validated
- [ ] Cloud detection stack alerted on simulated attack techniques

## References

- [MITRE ATT&CK Cloud Matrix](https://attack.mitre.org/matrices/enterprise/cloud/) — Cloud-specific techniques
- [CIS Cloud Benchmarks](https://www.cisecurity.org/benchmark) — Cloud hardening baselines
