Posts on: Red-Team

---

Practical field reference for assessing AWS environments from an attacker’s seat. Covers initial access, enumeration, privilege escalation, lateral movement, persistence, impact, detection/evasion, and tooling. The MCRTA chain is used as a worked example in §11. Authorized engagements only. Assume every API call is logged (CloudTrail); plan the detection story before the action, not after. AWS environments are heavily monitored by GuardDuty, Security Hub, and third-party EDRs. Move slowly, reuse existing artifacts, and understand the IP/User-Agent footprint you are leaving behind. 2025–2026 update: The attack surface has expanded dramatically. Bedrock AgentCore and Cognito are new privilege-escalation primitives. AI-assisted intrusion reached admin access in 8 minutes (Sysdig, Nov 2025). pathfinding.cloud catalogs 65+ verified IAM escalation paths and pathrunner automates them. Hostname obfuscation (nip.io, sslip.io, 1u.ms) bypasses IP blocklists for SSRF. AWS Config delivery-channel redirection and PutAlternateContact are stealthy persistence mechanisms. CloudFox v1.17.0+ is required after AWS changed its service-mapping format in Dec 2025.

Practical field reference for assessing Microsoft Azure / Entra ID (formerly Azure AD) environments from an attacker’s seat. Covers initial access, identity validation, enumeration, privilege escalation, lateral movement, persistence, impact, detection/evasion, and tooling. The MCRTA “meta-tech.cloud” chain (§11) is the worked example. Authorized engagements only. Every ARM/Graph call is logged in Activity Log / Entra audit logs; assume detection. Plan the OPSEC story before the action. 2025–2026 update: The Azure/Entra attack surface has expanded significantly. Federated Identity Credential (FIC) backdoors on managed identities and service principals are the new stealth persistence. OAuth Client ID Spoofing validates stolen credentials without generating a successful sign-in event. PRTremote extracts Primary Refresh Tokens via scheduled tasks over SMB. Key Vault backup/restore survives credential rotation. BloodHound CE v8+ with OpenGraph replaces the old Neo4j model. Storm-0501 and Storm-2949 demonstrate the full identity → Azure → ransomware kill chain. CVE-2026-62916 is a critical Entra ID authentication bypass.

Practical field reference for assessing Google Cloud Platform environments from an attacker’s seat. Covers initial access, identity validation, enumeration, privilege escalation, lateral movement, persistence, impact, detection/evasion, and tooling. The MCRTA “mcrta-exam” chain (§11) is the worked example. Authorized engagements only. Cloud Audit Logs record every Admin Activity call; assume detection. Plan the OPSEC story before the action. 2025–2026 update: The GCP attack surface has shifted. Almost every escalation path still routes through service-account impersonation (actAs, getAccessToken, signJwt), but the entry points have multiplied: Eventarc pipeline token exfiltration, Workload Identity Federation (WIF) provider abuse, Cluster Director startupScript replacement, and cross-tenant BigQuery repository takeover (CVE-2026-14934). Keyless persistence via IAM impersonation role grants and Cloud Scheduler OIDC beacons now rivals key creation. GCP-Hound brings GCP into BloodHound’s OpenGraph. Log sink redirection (UpdateSink) and audit log disablement are documented defense-evasion phases, catalogued under MITRE T1562.008.