Cloud infrastructure attacks target the Azure, AWS, or GCP control plane to gain privilege, exfiltrate data, deploy attacker-owned resources (cryptominers, C2 nodes), or destroy production assets. Unlike on-prem attacks, cloud compromise typically begins with a single stolen credential, OIDC token, or over-permissioned role and rapidly cascades through the control plane.
Detection requires fusing identity logs (Entra ID / IAM), control-plane logs (Activity Log / CloudTrail), and data-plane telemetry (Storage diagnostic logs, S3 access logs). The SOC's window between stolen credential and irrecoverable damage is often under 30 minutes — this SOP optimises for rapid triage and containment of the IAM identity before lateral spread into other subscriptions or accounts.
◈ Table of Contents
01
Background
CONTEXTB1Cloud Attack Phases & MITRE Mapping
| Phase | MITRE ATT&CK Cloud | Key Indicator | Severity |
|---|---|---|---|
| Initial Access — stolen credential | T1078.004 (Valid Cloud Accounts) | API calls from unfamiliar IP/ASN, unusual user-agent (e.g. python-requests, awscli with no MFA context) | HIGH |
| Persistence — backdoor service principal | T1098.001 (Additional Cloud Credentials) | CreateServicePrincipal, AddPasswordToApplication, CreateAccessKey on existing IAM user | CRITICAL |
| Privilege Escalation — role/policy abuse | T1548 (Abuse Elevation), T1098 | AttachUserPolicy, AddRoleToInstanceProfile, AzureRoleAssignmentCreate to Owner/Contributor | CRITICAL |
| Defense Evasion — log tampering | T1562.008 (Disable Cloud Logs) | StopLogging, DeleteTrail, DiagnosticSettings deleted, log destination changed | CRITICAL |
| Discovery — resource enumeration | T1580 (Cloud Infrastructure Discovery) | Burst of List* / Describe* / Get* API calls across many regions in short window | MEDIUM |
| Exfiltration — snapshot / bucket copy | T1537 (Transfer to Cloud Account) | CreateSnapshot then ModifySnapshotAttribute (share with foreign account); CopyObject to external bucket | CRITICAL |
| Impact — cryptomining / destruction | T1496 (Resource Hijacking), T1485 | Unusual VM/Function deploy in unused region; mass DeleteBucket / TerminateInstances | CRITICAL |
B2Log Sources
| Source | Table / Portal | Key Events |
|---|---|---|
| Azure Activity Log | AzureActivity (Sentinel) / Monitor → Activity Log | Microsoft.Authorization/roleAssignments/write, Microsoft.Compute/disks/beginGetAccess/action |
| Entra ID Audit + Sign-in | AuditLogs, SigninLogs | Add member to role, Update application–Certificates and secrets management, service principal sign-ins |
| AWS CloudTrail | AWSCloudTrail (Sentinel) / CloudTrail Lake | ConsoleLogin, AssumeRole, AttachUserPolicy, CreateAccessKey, PutBucketPolicy |
| Defender for Cloud | SecurityAlert | Suspicious account activity, anomalous resource creation, mass deletion alerts |
| GuardDuty (AWS) | GuardDutyFindings via Security Lake | UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration, Discovery:S3/MaliciousIPCaller |
| Storage diagnostic logs | StorageBlobLogs, StorageFileLogs / S3 server access logs | GetBlob/CopyBlob from foreign IP, mass List operations |
02
Identification
INVESTIGATECloud Infra — Investigation Workflow
I1Baseline the Suspect IdentityTRIAGE
- 1Confirm principal type: Is it a human user (Entra ID UPN / IAM user) or a workload identity (managed identity / service principal / IAM role)? Different containment paths.
- 2Check baseline behaviour: Pull last 30 days of activity for the principal. What regions, services, and call patterns are normal?
- 3Verify source IP / user-agent: Cross-reference against known corporate egress, VPN pools, and known automation runners. Anything outside that needs justification.
- 4Check for credential leakage: Search public sources (GitHub, paste sites, secret scanners) for the access key or token associated with the principal.
I2Azure — Privilege Escalation & Rogue Resource DetectionKQL
KQL — Sentinel: Role assignments granted to suspect principal
// Who got Owner/Contributor/User Access Administrator in the last 14 days
AzureActivity
| where TimeGenerated > ago(14d)
| where OperationNameValue =~ "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue == "Success"
| extend Props = parse_json(Properties)
| extend AssignedRole = tostring(Props.requestbody)
| where AssignedRole has_any ("Owner", "Contributor", "User Access Administrator", "Role Based Access Control Administrator")
| project TimeGenerated, Caller, CallerIpAddress, ResourceGroup, AssignedRole, _ResourceId
| order by TimeGenerated desc
KQL — New service principal credentials added (backdoor)
// Backdoor persistence — secret/cert added to existing app registration
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("Add password to application", "Add key to application", "Update application-Certificates and secrets management", "Update application-Credentials")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend App = tostring(TargetResources[0].displayName)
| project TimeGenerated, Actor, App, OperationName, ResultDescription
| order by TimeGenerated desc
KQL — Diagnostic settings / activity log tampering
// Detect log destruction — single most important defence-evasion signal
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue has_any (
"microsoft.insights/diagnosticSettings/delete",
"microsoft.insights/logProfiles/delete",
"Microsoft.OperationalInsights/workspaces/delete"
)
| project TimeGenerated, Caller, CallerIpAddress, OperationNameValue, _ResourceId, ActivityStatusValue
| order by TimeGenerated desc
If you see ANY diagnostic setting deletion that's not part of an approved change, treat the operating principal as compromised until proven otherwise — adversaries delete logs BEFORE the loud activity, not after.
I3AWS — IAM Abuse & Snapshot ExfilKQL + SPL
KQL — Sentinel: AWS IAM persistence (new access keys)
AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName in ("CreateAccessKey", "CreateLoginProfile", "UpdateLoginProfile", "AttachUserPolicy", "PutUserPolicy")
| extend Actor = tostring(parse_json(UserIdentity).arn)
| extend Target = tostring(parse_json(RequestParameters).userName)
| where Actor !contains Target // someone adding creds to a different user
| project TimeGenerated, Actor, Target, EventName, SourceIpAddress, UserAgent
| order by TimeGenerated desc
KQL — EBS snapshot shared to external account (exfil signal)
// ModifySnapshotAttribute granting createVolumePermission to a foreign AWS account
AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName == "ModifySnapshotAttribute"
| extend Params = parse_json(RequestParameters)
| extend Added = tostring(Params.createVolumePermission.add)
| where isnotempty(Added)
| project TimeGenerated, UserIdentity, SourceIpAddress, Params, Added
| order by TimeGenerated desc
SPL — Splunk: AssumeRole from unusual external account
index=aws sourcetype=aws:cloudtrail eventName=AssumeRole
| stats earliest(_time) as first_seen latest(_time) as last_seen count by userIdentity.arn, sourceIPAddress, requestParameters.roleArn
| where first_seen > relative_time(now(), "-7d@d")
| sort - count
The cleanest single signal of S3 exfil: a CopyObject call where source bucket is yours and destination bucket is in a foreign account. CloudTrail data events on S3 capture this — make sure they're enabled on crown-jewel buckets.
I4FP vs TP Decision Gate
| True-Positive Signals | False-Positive Signals |
|---|---|
| Activity from new ASN/region with no change ticket | Action matches an approved change record; same engineer on rota |
| Privilege escalation followed immediately by resource deploy in unused region | Routine Terraform/CI pipeline using its scoped service principal |
| Diagnostic settings deleted by service principal that has never managed monitoring | Documented log-pipeline migration with change record |
| API key created and used within minutes from a different geography | SRE rotating keys during scheduled rotation window |
| Mass List/Describe burst across all regions including ones you don't use | New compliance/CSPM scanner onboarded this week |
03
Containment
STOP ITC1Identity Containment — Within First 15 MinutesImmediate
- 1Disable principal: Entra ID → Users → [user] → Block sign-in / OR IAM Console → Users → Security credentials → Make access keys Inactive.
- 2Revoke all active sessions: Entra ID → Users → Revoke sessions. AWS —
aws iam delete-login-profile --user-name [name]+ force token expiry on assumed roles. - 3Rotate / deactivate all secrets: List all access keys, app passwords, and certificates on the principal. Mark each Inactive (do not delete — preserve for forensics).
- 4Remove role assignments granted during the incident window: Use the KQL list from I2 to identify and remove unauthorized role assignments via
az role assignment deleteor AWSdetach-user-policy. - 5Block attacker IP / ASN: Add to Conditional Access Named Location (Block); AWS — attach SCP/Deny policy on source IP CIDR.
Do NOT delete the principal yet — you need it intact for forensics. Disabling and rotating credentials achieves the same containment without destroying evidence.
C2Resource Containment
- 1Quarantine attacker-created resources: Apply a Deny-all NSG to attacker-created VMs (Azure) or attach a deny-everything Security Group (AWS) — keeps them alive for forensics but isolated.
- 2Lock down storage: If attacker accessed storage, enable resource locks, change account access keys, and revoke SAS tokens (
az storage account revoke-delegation-keys). - 3Block snapshot sharing: If you saw
ModifySnapshotAttribute, immediately revoke createVolumePermission and disable cross-account snapshot copy. - 4Force re-enablement of logging: If diagnostic settings/CloudTrail were tampered, restore them immediately. Use organisation-level CloudTrail in AWS / Azure Policy enforcement to prevent re-tampering.
04
Eradication
CLEAN UPE1Full Identity & Persistence Cleanup
- 1After forensic snapshot taken, delete attacker-added secrets/keys/certificates on every principal the attacker touched (not just the original).
- 2Audit every service principal / IAM role that was modified during the incident window. Restore each to its pre-incident permission set or recreate from IaC source of truth.
- 3Search for backdoor automation: Logic Apps, Azure Functions, Lambda, Step Functions, Automation Runbooks, EventBridge rules created during the incident window. Disable and review each.
- 4Verify clean state — re-run the KQL queries from I2 and I3 with the incident window; expected result: zero matches.
- 5Close the entry point: enforce MFA + Conditional Access on all admin principals, rotate any long-lived static credentials in favour of managed identities or IAM roles.
Eradication Complete When
- All attacker-created secrets, role assignments, and resources removed or restored from IaC
- Logging restored across every subscription/account and verified end-to-end
- Re-run of detection KQLs shows zero matches in the incident window
- Conditional Access enforced on all human admins; MFA required for break-glass accounts
- Entry-point credential rotated and root cause documented in post-incident review
05
Escalation
TIERSESC1Escalation Tiers
| Tier | Trigger | Action / Handoff Bundle |
|---|---|---|
| L1 → L2 | Cannot determine TP/FP in 30 min, OR action involves a privileged principal (Owner/Contributor/IAM admin), OR more than one subscription/account is touched | Provide: principal ID/UPN, suspect IP, KQL/CloudTrail result set, baseline diff (what's new), list of touched resources |
| L2 → IR Team | Confirmed identity compromise, OR rogue resource deployed, OR log tampering observed | Open IR ticket. Bundle: forensic snapshot of attacker resources, timeline, principal IDs, IPs/ASNs, rotated credential list |
| IR → CISO + Legal + Privacy | Confirmed data exfil (snapshot share / bucket copy to external), OR customer/PII data class touched, OR regulated workload affected (PCI/HIPAA/GDPR scope) | Disclosure assessment, regulator notification path, customer comms drafted, external IR firm engaged |
| External | Active in-progress attack, OR cryptojacking causing significant cost, OR ransom email received | Engage cloud provider's IR (Microsoft DART / AWS Customer Incident Response Team). For ransom — law enforcement (FBI IC3 / local equivalent) |
Authorized security research & penetration testing only. Unauthorized use is illegal. Authored by Rudra Verma | Senior Security Architect | CyberHawk Threat Intel.