Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Abuse of Trusted Cloud Services

Abuse of Trusted Cloud Services

3 min read

Jump to:

Overview

Abuse of trusted cloud services involves adversaries leveraging legitimate cloud platforms and services to facilitate various stages of an attack. This technique enables attackers to blend malicious activity with normal cloud operations, complicating detection and response efforts. It is commonly employed across multiple phases of the attack lifecycle to exploit the inherent trust and widespread use of cloud infrastructure.

Attack Objective

Achieve stealthy access, execution, persistence, or data exfiltration by leveraging trusted cloud environments
Supports multiple stages including Initial Access, Execution, Persistence, Defense Evasion, Command & Control, and Exfiltration
Advances attacker position by using cloud services to mask malicious actions, evade defenses, and maintain operational continuity

How the Technique Works

Adversaries exploit legitimate cloud services—such as storage, compute, messaging, or identity platforms—to perform malicious activities under the guise of normal cloud usage. This may include hosting malicious payloads, executing commands, maintaining persistence through cloud identities, or exfiltrating data via cloud storage. By using trusted cloud infrastructure, attackers reduce the likelihood of detection and leverage the scalability and availability of these services to support their operations.

Common Methods & Variations

Utilizing cloud storage services to host malware or exfiltrate data
Abusing cloud compute instances or serverless functions for code execution
Leveraging cloud identity and access management (IAM) roles or tokens for persistence and privilege escalation
Employing cloud-based messaging or collaboration platforms for command and control communication
Living-off-the-land approaches using native cloud tools and APIs versus deploying custom tooling within cloud environments

Indicators of Compromise (IOCs)

Unusual or unauthorized cloud API calls and access patterns
Creation or modification of cloud identities, roles, or permissions inconsistent with normal operations
Unexpected data transfers to or from cloud storage buckets or services
Execution of unfamiliar or anomalous workloads on cloud compute resources
Network traffic patterns indicating communication with known malicious cloud endpoints or unusual command and control channels

Detection Strategies

Monitoring cloud service logs, including API access logs, identity and access management events, and storage access records
Behavioral analysis to identify deviations from established cloud usage baselines
Correlation of cloud telemetry with endpoint and network data to detect cross-environment anomalies
Signature-based detection for known malicious cloud activity patterns combined with anomaly detection for novel abuse

Mitigation & Prevention

Implementing least privilege principles and strict access controls for cloud identities and resources
Enforcing multi-factor authentication and strong credential management for cloud accounts
Regularly auditing cloud configurations, permissions, and activity logs to identify and remediate misconfigurations
Applying network segmentation and egress filtering to limit unauthorized data flows to and from cloud services
Utilizing cloud-native security features such as anomaly detection and threat intelligence integration

Response Considerations

Immediate revocation or suspension of compromised cloud credentials and access tokens
Comprehensive investigation of cloud activity logs to determine scope and timeline of abuse
Containment of affected cloud resources and isolation of malicious workloads
Remediation of misconfigurations and reinforcement of cloud security policies
Post-incident review to update detection rules and improve cloud security posture

Related Techniques

Credential Access through cloud identity compromise
Command and Control via cloud-based infrastructure
Data Staged and Exfiltration using cloud storage services
Persistence through cloud account or role abuse
Defense Evasion by leveraging trusted cloud service reputations

Mapping & References

MITRE ATT&CK: Initial Access (T1078), Execution (T1106), Persistence (T1078), Defense Evasion (T1562), Command and Control (T1095), Exfiltration (T1567)
Public research on cloud abuse techniques from cybersecurity firms and cloud providers
Advisories detailing incidents involving misuse of cloud services for malicious purposes

Tags: Cloud Identity Management Cloud Security Command and Control Defense Evasion Execution Exfiltration Incident Response Initial Access persistence Threat Detection