<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-detection-rules
description: >-
  Author, test, and deploy detection rules for AWS, Azure, and GCP cloud environments covering identity, data, network, and compute threat patterns.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - cloud-detection
  - aws-security
  - azure-security
  - gcp-security
  - cloudtrail
  - cloud-audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Implementing Cloud Detection Rules

## Overview

Cloud detection rules address threats unique to cloud environments including
identity abuse, privilege escalation, data exfiltration, and resource hijacking.
Covers CloudTrail, Azure Activity Log, GCP Audit Log, and cloud-native SIEM integration.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Cloud CLI tools | aws-cli, az-cli, or gcloud |
| Cloud audit logs | CloudTrail, Azure Activity, GCP Audit enabled |
| SIEM integration | Log forwarding configured |

## Key Concepts

### Cloud Detection Patterns

```yaml
# Sigma rule for AWS credential abuse
title: AWS IAM User Created with Console Access
id: 3a8b7c2d-1e4f-5a6b-9c0d-8e7f6a5b4c3d
status: experimental
description: >-
  Detects creation of IAM users with console login profile,
  indicating potential persistence mechanism.
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName:
      - CreateUser
      - CreateLoginProfile
  condition: selection
level: high
tags:
  - attack.persistence
  - attack.t1136.003
```

## Workflow

1. **Map cloud threats** — Identify cloud-specific TTPs and abuse patterns
2. **Inventory log sources** — Catalog available cloud audit telemetry
3. **Author rules** — Write detection logic for cloud provider events
4. **Test with samples** — Validate against recorded cloud audit events
5. **Tune for environment** — Filter legitimate automation and service accounts
6. **Deploy to cloud SIEM** — Push rules to cloud-native or centralized SIEM
7. **Monitor efficacy** — Track alert quality and cloud coverage metrics

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
