cloud-defense

Name: cloud-defense
Author: transilienceai

423stars74forks

How to install cloud-defense?

transilienceai/communitytools/cloud-defense

$npx -y skills add transilienceai/communitytools --skill cloud-defense

Installs into the current project.

Summary

Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team po

Files · 1

View on GitHub

SKILL.md

1	# Cloud Defense
2
3	The blue-team counterpart to [`cloud-containers`](../cloud-containers/SKILL.md). For each attacker move — lateral movement, privilege escalation, data exfiltration, defense evasion — this skill gives the log event to alert on and the single control that removes the technique. Use it to turn an offensive cloud finding into a concrete detection and remediation.
4
5	## When to use
6
7	- Writing the remediation / hardening section of a cloud pentest report.
8	- Cloud detection engineering: deciding which control-plane events to alert on.
9	- Reviewing an AWS / Azure / GCP account's posture against the post-compromise chain.
10
11	## Workflow
12
13	1. Confirm the logging prerequisites are in place (org-wide trail, data events, threat detection on) — without them the signals below are invisible.
14	2. Map each attacker stage to its detection signal — see [reference/detection-signals.md](reference/detection-signals.md).
15	3. Apply the preventive control that breaks each stage — see [reference/hardening-controls.md](reference/hardening-controls.md).
16	4. Re-run the matching offensive technique from [`cloud-containers`](../cloud-containers/SKILL.md) to confirm the control holds or the alert fires.
17
18	## References
19
20	- [reference/INDEX.md](reference/INDEX.md) — router
21	- [reference/detection-signals.md](reference/detection-signals.md) — per-stage log signals + logging prerequisites
22	- [reference/hardening-controls.md](reference/hardening-controls.md) — the control that breaks each stage

People who liked this also viewed

6 picks

Type

cloud-defense

423stars74forks

View on GitHub

How to install cloud-defense?

transilienceai/communitytools/cloud-defense

$npx -y skills add transilienceai/communitytools --skill cloud-defense

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Cloud Defense
2
3	The blue-team counterpart to [`cloud-containers`](../cloud-containers/SKILL.md). For each attacker move — lateral movement, privilege escalation, data exfiltration, defense evasion — this skill gives the log event to alert on and the single control that removes the technique. Use it to turn an offensive cloud finding into a concrete detection and remediation.
4
5	## When to use
6
7	- Writing the remediation / hardening section of a cloud pentest report.
8	- Cloud detection engineering: deciding which control-plane events to alert on.
9	- Reviewing an AWS / Azure / GCP account's posture against the post-compromise chain.
10
11	## Workflow
12
13	1. Confirm the logging prerequisites are in place (org-wide trail, data events, threat detection on) — without them the signals below are invisible.
14	2. Map each attacker stage to its detection signal — see [reference/detection-signals.md](reference/detection-signals.md).
15	3. Apply the preventive control that breaks each stage — see [reference/hardening-controls.md](reference/hardening-controls.md).
16	4. Re-run the matching offensive technique from [`cloud-containers`](../cloud-containers/SKILL.md) to confirm the control holds or the alert fires.
17
18	## References
19
20	- [reference/INDEX.md](reference/INDEX.md) — router
21	- [reference/detection-signals.md](reference/detection-signals.md) — per-stage log signals + logging prerequisites
22	- [reference/hardening-controls.md](reference/hardening-controls.md) — the control that breaks each stage

People who liked this also viewed

6 picks

Type