Hunting For Living Off The Cloud Techniques
FreeProactively detect cloud service abuse by adversaries.
Free · Opens the source repo
What Hunting For Living Off The Cloud Techniques does
This skill focuses on identifying and mitigating adversarial abuse of legitimate cloud services such as Azure, AWS, GCP, and various SaaS platforms. It specifically targets command-and-control (C2) channels, data staging, and exfiltration techniques that blend in with normal cloud activity. By leveraging threat intelligence and established frameworks like MITRE ATT&CK, users can enhance their threat hunting capabilities in cloud environments.
The skill is designed for security professionals who are engaged in proactive threat hunting, incident response, or security assessments. It provides a structured workflow to formulate hypotheses based on threat intelligence, identify relevant data sources, execute detection queries, and analyze the results for potential threats. The output format is standardized to facilitate documentation and reporting of findings, ensuring that security teams can act swiftly and effectively.
To utilize this skill effectively, users need to have a robust security infrastructure in place, including an EDR platform with telemetry capabilities and a SIEM system for log analysis. The skill also emphasizes the importance of having threat intelligence feeds for correlating indicators of compromise (IOCs) and ensuring comprehensive monitoring of cloud activities. By following the outlined workflow, teams can systematically hunt for living-off-the-cloud techniques and respond to potential threats before they escalate.
This skill is particularly useful in scenarios where threat intelligence indicates active campaigns exploiting cloud services, or when anomalous behavior is detected in cloud environments. It allows security teams to stay one step ahead of adversaries who leverage legitimate services for malicious purposes.
When to use it
Use this skill when actively hunting for indicators of cloud service abuse or during incident response to assess potential compromises related to these techniques.
When not to use it
This skill may not be suitable for environments without adequate telemetry or those not utilizing cloud services, as it relies on specific data sources for effective detection.
What you can build with it
Identifying C2 Channels
Use this skill to hunt for command-and-control channels established through legitimate cloud services.
Data Exfiltration Detection
Employ the skill to detect data being staged or exfiltrated using cloud storage solutions.
Incident Response Support
Integrate this skill during incident response to assess and scope compromises linked to cloud service abuse.
How to install Hunting For Living Off The Cloud Techniques
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-living-off-the-cloud-techniques --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Living Off The Cloud Techniques
When to Use
- When proactively hunting for indicators of hunting for living off the cloud techniques in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1102 | Web Service |
| T1567 | Exfiltration Over Web Service |
| T1537 | Transfer Data to Cloud Account |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: C2 over Discord webhooks for command delivery
- Scenario 2: Data exfiltration to Telegram bot API
- Scenario 3: Malware using Azure Functions for dynamic C2
- Scenario 4: Staging stolen data on Google Docs or Notion pages
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1102
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Living Off The Cloud Techniques
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.