Elastic Outlines a Plan-First Method for Cloud Threat Emulation
Summary
Elastic outlines a cloud threat-emulation lifecycle: define scope, model the threat and victim environment, execute with realistic identities, verify real telemetry and detection coverage, document findings, and clean up resources.
Key points
- The methodology starts with objectives and a threat model, then models the victim environment, starting identity, permissions, and operational flow before execution.
- Emulations can use atomic, micro, or full scope, depending on whether the goal is to test one technique, a short chain, or end-to-end behavior.
- Cloud testing must account for IAM progression, control-plane APIs, eventual consistency, and logging delays; endpoint-style tests may not capture these factors.
- Use controlled, disposable labs and unique run tags; track both provisioned resources and attacker-created leftovers for complete cleanup.
- Verify expected events in actual logs rather than relying on assumptions about telemetry or field names; missing or partial logs can reveal detection gaps.
- Test rules against the exercise’s events and check whether they fire for the intended reason; ATT&CK mappings alone do not demonstrate effective coverage.
- Automation can handle repetitive tasks, but engineers remain responsible for realism, assumptions, detection value, and cleanup verification.
Article Details
- Defense Focus
- Use realistic, plan-first cloud threat emulation to validate detection coverage against actual telemetry, identify logging gaps, and improve detection engineering.
- Detection Methods
- Define an objective and atomic, micro, or full scope; threat-model the activity and victim environment before execution.
- Use a realistic starting identity and model IAM progression, permissions, prerequisites, and expected outcomes for each step.
- Verify that relevant logging is enabled, then inspect raw events and compare observed fields and timing with expectations.
- Run the exercise's events against existing rules and assess whether alerts fire for the intended behavior and telemetry.
- Investigate missing, late, or partial telemetry as potential detection gaps; decide whether to add or tune a rule, hunt, request logging, or investigate further.
- Tag each run and use the tag to correlate telemetry and locate resources during cleanup.
- Data Sources
- AWS CloudTrail management events
- AWS CloudTrail data events, including S3 object-access events
- Azure Activity Logs
- Entra ID sign-in and audit telemetry
- Raw cloud events observed during the emulation
- Rule Types
- Detection-rule TOML and query-based rules
- ES|QL queries for filtering CloudTrail logs and correlating run tags
- Platforms
- AWS cloud control plane
- Azure cloud control plane and identity plane
- Defensive Actions
- Confirm expected logging is configured before execution, particularly for data-access events.
- Allow for IAM propagation and log-ingestion delays; poll for credentials and give logs time to settle before concluding telemetry is absent.
- Use dedicated identities and resources in controlled, disposable labs; restrict inbound access and avoid broad 0.0.0.0/0 access.
- Track and remove attacker-created resources, including orphaned users, keys, and role assignments, before destroying provisioned infrastructure.
- Verify cleanup by run tag, remove temporary credentials and exercise-enabled logging, and document assumptions, failures, telemetry, and coverage results.
MITRE ATT&CK
T1078 · Valid AccountsThe methodology recommends beginning from a realistic compromised identity, such as stolen credentials or an assumed role, rather than defaulting to administrator access.T1087 · Account DiscoveryThe methodology includes enumerating identities, roles, instance profiles, and available permissions.T1098 · Account ManipulationThe article describes emulations creating backdoor users, keys, and role assignments, which must be tracked and removed.T1528 · Steal Application Access TokenA contextual identity-abuse example takes an MFA auth code and exchanges it with Entra for a refresh token.T1530 · Data from Cloud StorageAn example scenario lists and retrieves S3 objects using ListBucket and GetObject permissions before staging the data.T1567.002 · Exfiltration to Cloud StorageThe S3 example moves data to an external bucket using PutObject as an exfiltration path.T1580 · Cloud Infrastructure DiscoveryThe article describes discovering cloud resources such as security groups and buckets as part of an emulated intrusion path.
Vendors
Amazon Web Services[Cloud services / platforms] identity, logging, and storage targets – AWS CloudTrail, S3, Azure Activity Logs, Entra IDMicrosoftIf Microsoft or another shop publishes end-to-end research across hybrid Windows, Entra, AD, and M365, skipping environment fidelity is how you get a demo that fires APIs and teaches you almost nothing about detection.
Products
AWS CloudTrail[Cloud services / platforms] identity, logging, and storage targets – AWS CloudTrail, S3, Azure Activity Logs, Entra IDAzure Activity Logs[Cloud services / platforms] identity, logging, and storage targets – AWS CloudTrail, S3, Azure Activity Logs, Entra IDEC2EC2 instance profile, GKE pod SA, Azure VM managed identityEntra ID[Cloud services / platforms] identity, logging, and storage targets – AWS CloudTrail, S3, Azure Activity Logs, Entra IDS3[T1530 ] Data from Cloud Storage – It gives an example of staging and exfiltrating S3 objects, including ListBucket/GetObject and copying to an external bucket (‘Exfiltrate data from S3’, ‘Copy to a same-account staging
Tools
Atomic Red TeamTooling such as Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, and Splunk ATT&CK Range can help, but the methodology matters more than the tool.CloudGoatTooling such as Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, and Splunk ATT&CK Range can help, but the methodology matters more than the tool.ROADToolsTooling such as Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, and Splunk ATT&CK Range can help, but the methodology matters more than the tool.Splunk ATT&CK RangeTooling such as Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, and Splunk ATT&CK Range can help, but the methodology matters more than the tool.Stratus Red TeamTooling such as Stratus Red Team, Atomic Red Team, CloudGoat, ROADTools, and Splunk ATT&CK Range can help, but the methodology matters more than the tool.