Cloud Threats — Credential Theft, IMDS Abuse, Hijacking

What Makes Cloud Threats Different

• Cloud environments change the threat model fundamentally. There is no “endpoint” to compromise in the traditional sense — an attacker can compromise an organization through an exposed S3 bucket, a leaked API key on GitHub, a misconfigured IAM role, or a compromised third-party SaaS integration.
• Traditional EDR agents do not run in cloud APIs or serverless functions. Cloud threats require cloud-native detection — CloudTrail, CloudWatch, Azure Activity Log, Azure Monitor, GCP Cloud Audit Logs, and SaaS audit logs.
• The shared responsibility model means the cloud provider secures the infrastructure, but the customer secures everything they put in it: identities, data, configurations, networks, and applications. See Cloud Security Fundamentals for details on the shared responsibility model.
• MITRE ATT&CK maps cloud attacks across multiple tactics: T1525 (Cloud Service Discovery), T1552.005 (Cloud Instance Metadata API), T1613 (Container and Resource Discovery), T1078 (Valid Accounts).

Cloud Credential Theft

Cloud credentials — API keys, access keys, service principal secrets, and OAuth tokens — are the most valuable target in any cloud environment.

How Attackers Steal Cloud Credentials

Detection — IMDS Attack (Instance Metadata Service)

The IMDS endpoint at 169.254.169.254 provides temporary cloud credentials to any process running on the instance. If an attacker gains code execution on a cloud VM, the first thing they do is query IMDS.

IMDS query commands:

# AWS — get IAM role credentials
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME

# Azure — get managed identity token
curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -H Metadata:true

# GCP — get service account access token
curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" -H "Metadata-Flavor: Google"

Detection — SPL query for IMDS access:

index=web sourcetype=webserver_logs
| search dest_ip="169.254.169.254" OR uri="*metadata*" OR uri="*/latest/meta-data/*"
| stats count by src_ip, user_agent, uri
| eval alert = "INSTANCE METADATA ACCESS — possible IMDS attack from " . src_ip
| table _time, src_ip, uri, user_agent, count, alert

Detection — CloudTrail for unusual credential usage:

index=aws sourcetype=cloudtrail
| search userIdentity.type=AssumedRole userIdentity.sessionContext.sessionIssuer.userName=*
| where userIdentity.arn != sourceIPAddress ~ "internal-network"
| eval alert = "IMDS credentials used from outside the VPC — possible credential theft"
| table _time, userIdentity.arn, sourceIPAddress, eventName, eventSource, alert

Resource Hijacking

Cloud resource hijacking occurs when an attacker uses compromised cloud credentials to provision resources — typically for cryptomining, but also for C2 infrastructure, spam campaigns, or data exfiltration.

Common Hijacking Patterns

Detection — Resource Hijacking

CloudTrail — detect unusual instance launches:

index=aws sourcetype=cloudtrail eventName=RunInstances
| stats count by userIdentity.arn, sourceIPAddress, requestParameters.instanceType, bin(_time, 1h)
| eval alert = if(match(requestParameters.instanceType, "(p3|p4|g4|g5|inf1|f1)"), "HIGH — GPU/FPGA instance launched, possible cryptomining", "INFO — instance launch")
| table _time, userIdentity.arn, sourceIPAddress, requestParameters.instanceType, count, alert
| sort - _time

SPL — detect unusual cost/anomaly alerts from cloud provider billing:

index=cloud_billing sourcetype=aws_cost_explorer
| stats sum(cost) as total_cost by service, region, bin(_time, 1d)
| where total_cost > 1000
| eval alert = "HIGH spend on " . service . " in " . region . " — $" . round(total_cost)
| table _time, service, region, total_cost, alert
| sort - total_cost

Cloud Privilege Escalation

Cloud IAM is complex — and complexity breeds misconfigurations that allow privilege escalation.

Common Escalation Paths

Detection — Privilege Escalation

CloudTrail — detect IAM policy changes:

index=aws sourcetype=cloudtrail
| search eventSource="iam.amazonaws.com" (eventName=CreatePolicy OR eventName=CreatePolicyVersion OR eventName=SetDefaultPolicyVersion OR eventName=AttachRolePolicy OR eventName=AttachUserPolicy)
| stats count by userIdentity.arn, sourceIPAddress, eventName, requestParameters.policyArn
| eval alert = "IAM policy change by " . userIdentity.arn . " — " . eventName
| table _time, userIdentity.arn, sourceIPAddress, eventName, requestParameters.policyArn, alert
| sort - _time

SaaS Compromise Patterns

SaaS applications (O365, GWS, Slack, GitHub, Salesforce) have their own threat landscape that does not map neatly to IaaS monitoring.

Key SaaS Attack Vectors

Detection — OAuth App Abuse in Azure AD

index=azure sourcetype=audit_logs
| search OperationName="Consent to application" OR OperationName="Add OAuth2PermissionGrant"
| where TargetResources{}.displayName NOT IN (known_approved_apps)
| stats values(TargetResources{}.displayName) as AppName, values(InitiatedBy.user.userPrincipalName) as User by Result, bin(_time, 1d)
| eval alert = "New OAuth app consent: " . mvjoin(AppName, ", ") . " by " . User
| table _time, User, AppName, Result, alert

Detection — Mailbox forwarding rules in Exchange Online:

index=m365 sourcetype=exchange_admin
| search Operation="New-InboxRule" OR Operation="Set-InboxRule"
| where Parameters.ForwardTo OR Parameters.ForwardingSmtpAddress
| eval alert = "Mailbox forwarding rule created — possible data exfiltration"
| table _time, UserId, Parameters, alert

Key Detection Tables — Cloud Threat Quick Reference

Related

• Privilege Escalation Investigation — detection and response for T1068 techniques
• Cloud Security Fundamentals — detection and response for T1525 techniques
• Cloud Incident Response — detection and response for T1525, T1526, T1078, T1530 techniques
• Container and Kubernetes Threats — detection and response for T1611, T1525, T1574.002 techniques
• Golden Ticket Attack — detection and response for T1558.001 techniques

Sources

• MITRE ATT&CK — T1552.005 (Cloud Instance Metadata API)
• MITRE ATT&CK — T1525 (Cloud Service Discovery)
• AWS Security Blog — IAM Best Practices
• Azure AD — OAuth Attack Detection
• GCP — Cloud Audit Logs
• OWASP — Cloud Security Top 10