What it does. Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/hunting-for-living-off-the-cloud-techniques/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-living-off-the-cloud-techniques, or copy the skill folder into ~/.claude/skills/hunting-for-living-off-the-cloud-techniques/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md

SKILL.md (verbatim)

name: hunting-for-living-off-the-cloud-techniques
description: Hunts for adversary abuse of legitimate cloud services (Azure, AWS, GCP,
  and SaaS platforms) for command-and-control, data staging, and exfiltration, i.e.
  "living off the cloud" tradecraft that blends in with normal cloud API and service
  activity. Use when threat hunting for cloud-native C2 channels, abnormal use of
  storage/SaaS services for data staging, or exfiltration hidden in legitimate cloud
  traffic.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- mitre-attack
- cloud-abuse
- c2
- lotc
- saas
- proactive-detection
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Network Traffic Community Deviation
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1048

Hunting For Living Off The Cloud Techniques

When to Use

• When proactively hunting for indicators of hunting for living off the cloud techniques in the environment
• After threat intelligence indicates active campaigns using these techniques
• During incident response to scope compromise related to these techniques
• When EDR or SIEM alerts trigger on related indicators
• During periodic security assessments and purple team exercises

Prerequisites

• EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
• SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
• Sysmon deployed with comprehensive configuration
• Windows Security Event Log forwarding enabled
• Threat intelligence feeds for IOC correlation

Workflow

1. Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
2. Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
3. Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
4. Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
5. Validate Findings: Distinguish true positives from false positives through contextual analysis.
6. Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
7. Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

Concept	Description
T1102	Web Service
T1567	Exfiltration Over Web Service
T1537	Transfer Data to Cloud Account

Tools & Systems

Tool	Purpose
CrowdStrike Falcon	EDR telemetry and threat detection
Microsoft Defender for Endpoint	Advanced hunting with KQL
Splunk Enterprise	SIEM log analysis with SPL queries
Elastic Security	Detection rules and investigation timeline
Sysmon	Detailed Windows event monitoring
Velociraptor	Endpoint artifact collection and hunting
Sigma Rules	Cross-platform detection rule format

Common Scenarios

1. Scenario 1: C2 over Discord webhooks for command delivery
2. Scenario 2: Data exfiltration to Telegram bot API
3. Scenario 3: Malware using Azure Functions for dynamic C2
4. Scenario 4: Staging stolen data on Google Docs or Notion pages

Output Format

Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1102
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Hunting For Living Off The Cloud Techniques - Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-HUNTIN-YYYY-MM-DD-NNN
Analyst
Date Started
Date Completed
Status	[ ] In Progress / [ ] Complete
Priority	[ ] Critical / [ ] High / [ ] Medium / [ ] Low

Hypothesis

Statement: [Formulate a clear, testable hypothesis]

Basis: [ ] Threat Intel / [ ] ATT&CK Gap / [ ] Anomaly / [ ] Incident Follow-up

Target Techniques

• T1102 - Web Service
• T1567 - Exfiltration Over Web Service
• T1537 - Transfer Data to Cloud Account

Data Sources

• Sysmon Event Logs
• Windows Security Event Logs
• EDR Telemetry (Platform: _____________)
• SIEM (Platform: _____________)
• Network Logs (Proxy/Firewall/DNS)
• Cloud Audit Logs
• Email Gateway Logs
• Application Logs

Queries Executed

Query 1: [Description]

[Query text]

Results: [Count] events | Execution Time: [Duration]

Query 2: [Description]

[Query text]

Results: [Count] events | Execution Time: [Duration]

Findings

#	Timestamp	Host	User	Technique	Evidence Summary	Risk	Verdict
1							TP / FP / BTP
2							TP / FP / BTP
3							TP / FP / BTP

IOCs Discovered

Network IOCs

Type	Value	Context	Confidence
IP
Domain
URL

Host IOCs

Type	Value	Context	Confidence
SHA256
Filename
Registry Key
Scheduled Task

Hunt Results Summary

Metric	Count
Total Events Analyzed
Anomalies Identified
True Positives
False Positives
Benign True Positives
New IOCs Discovered
Detection Rules Created
Detection Rules Updated

Hypothesis Outcome

• Confirmed: Evidence supports the hypothesis
• Partially Confirmed: Some evidence found, further investigation needed
• Refuted: No evidence found
• Inconclusive: Insufficient data

Recommendations

1. Immediate Actions: [Containment, remediation steps]
2. Detection Improvements: [New rules, tuning recommendations]
3. Visibility Gaps: [Missing data sources, coverage needs]
4. Security Hardening: [Configuration changes, policy updates]
5. Follow-up Hunts: [Related hypotheses to investigate]

Analyst Notes

[Free-form notes, observations, and lessons learned]

references/api-reference.md (verbatim)

API Reference — Hunting for Living-off-the-Cloud Techniques

Libraries Used

• elasticsearch (elasticsearch-py): Query Elastic SIEM for cloud abuse indicators
• re: Pattern matching against cloud C2 domain patterns in DNS logs

CLI Interface

python agent.py hunt --es-host <url> --index <pattern> [--api-key <key>] [--hours <n>]
python agent.py dns --log-file <path>

Core Functions

hunt_lotc_elastic(es_host, es_index, api_key=None, hours=24)

Executes five pre-built hunting queries against Elasticsearch to detect cloud service abuse.

Parameters:

Name	Type	Description
es_host	str	Elasticsearch host URL (e.g., https://es:9200)
es_index	str	Index pattern (default: logs-*)
api_key	str	Optional API key for authentication
hours	int	Lookback window in hours

Returns: dict with hunts list (each with name, description, hits, events) and total_hits.

analyze_dns_logs(log_file)

Scans DNS query log files for connections to known cloud services used for C2, staging, and exfiltration.

Parameters:

Name	Type	Description
log_file	str	Path to DNS query log file

Returns: dict with total_matches, findings list, and cloud_services_detected.

Hunting Queries

Query Name	MITRE Technique	Description
azure_storage_exfil	T1567.002	Large uploads to Azure Blob Storage
aws_s3_staging	T1537	Unusual S3 bucket creation or large PutObject
saas_c2_channel	T1102	Outbound connections to SaaS APIs (Telegram, Slack, Discord)
cloud_function_invoke	T1584.007	Cloud function invocation via LOLBins
github_raw_download	T1105	Payload downloads from raw GitHub content

Elasticsearch API Calls

• Elasticsearch(hosts=[url], api_key=key) — Initialize client
• es.search(index=pattern, body=query) — Execute search query
• Response: resp["hits"]["total"]["value"], resp["hits"]["hits"][]._source

Dependencies

pip install elasticsearch>=8.0

references/standards.md (verbatim)

Standards and References - Hunting For Living Off The Cloud Techniques

MITRE ATT&CK Mappings

Technique	Name	Description
T1102	Web Service	See attack.mitre.org/techniques/T1102
T1567	Exfiltration Over Web Service	See attack.mitre.org/techniques/T1567
T1537	Transfer Data to Cloud Account	See attack.mitre.org/techniques/T1537

Detection Data Sources

Source	Event ID	Purpose
Sysmon	1	Process creation with command line
Sysmon	3	Network connection initiated
Sysmon	7	Image loaded (DLL)
Sysmon	10	Process access (LSASS)
Sysmon	11	File creation
Sysmon	12/13	Registry create/set
Sysmon	22	DNS query
Sysmon	25	Process tampering
Windows Security	4624	Successful logon
Windows Security	4625	Failed logon
Windows Security	4648	Explicit credential logon
Windows Security	4672	Special privileges assigned
Windows Security	4688	Process creation
Windows Security	4697	Service installed
Windows Security	4698	Scheduled task created
Windows Security	4769	Kerberos TGS requested
Windows Security	5140	Network share accessed

References

• MITRE ATT&CK Framework: https://attack.mitre.org/
• Sigma Detection Rules: https://github.com/SigmaHQ/sigma
• LOLBAS Project: https://lolbas-project.github.io/
• Atomic Red Team Tests: https://github.com/redcanaryco/atomic-red-team
• Red Canary Threat Detection Report
• SANS Threat Hunting Summit Resources

references/workflows.md (verbatim)

Detailed Hunting Workflow - Hunting For Living Off The Cloud Techniques

Phase 1: Data Collection and Querying

Splunk SPL Query

index=proxy
| where match(dest, "(?i)(pastebin|discord|telegram|notion|trello|slack|github\.io|workers\.dev|azurewebsites\.net|firebaseio)")
| where method IN ("POST", "PUT")
| stats sum(bytes_out) as uploaded count by src_ip dest user
| where count > 20 OR uploaded > 10485760

KQL Query (Microsoft Defender for Endpoint)

DeviceNetworkEvents
| where RemoteUrl has_any ("pastebin.com","discord.com","api.telegram.org","notion.so","trello.com")
| summarize Count=count(), BytesOut=sum(SentBytes) by DeviceName, RemoteUrl
| where Count > 20

Phase 2: Baseline and Anomaly Detection

Step 2.1 - Establish Normal Behavior Baseline

• Collect 30 days of historical data for the targeted technique
• Document expected patterns, frequencies, and legitimate use cases
• Identify known false positive sources and document exceptions
• Build statistical baseline (mean, standard deviation) for key metrics

Step 2.2 - Identify Anomalies

• Compare current activity against the 30-day baseline
• Flag events exceeding 3 standard deviations from normal
• Prioritize anomalies by risk score and potential business impact
• Cross-reference with threat intelligence for known IOCs

Phase 3: Investigation and Correlation

Step 3.1 - Deep Dive Analysis

• For each anomaly, collect full process tree context
• Correlate with network activity, file operations, and authentication events
• Check binary signatures, file hashes, and certificate validity
• Review user account context and access patterns

Step 3.2 - Attack Chain Reconstruction

• Map findings to MITRE ATT&CK kill chain stages
• Identify initial access vector if applicable
• Trace lateral movement and privilege escalation paths
• Determine data access and potential exfiltration

Phase 4: Validation and Response

Step 4.1 - True/False Positive Determination

• Verify findings with system owners and IT operations
• Check change management records for authorized activities
• Validate user context (authorized actions vs. compromised account)
• Document determination rationale for each finding

Step 4.2 - Response Actions

• For confirmed threats: initiate incident response procedures
• For detection gaps: create or update detection rules
• For false positives: tune existing rules and update exclusions
• Update threat hunting playbook with lessons learned

Phase 5: Documentation and Reporting

Step 5.1 - Hunt Report

• Summarize hypothesis, methodology, and findings
• Include all queries executed and their results
• Document IOCs discovered and detection rules created
• Provide recommendations for security improvements

Step 5.2 - Knowledge Base Update

• Add findings to threat intelligence platform
• Update MITRE ATT&CK coverage heatmap
• Share detection rules via Sigma format
• Schedule follow-up hunts for related techniques

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.