#mitreattack — Public Fediverse posts

----------------

🛠️ Tool
===================

Cloud Threat Emulation on Autopilot: Context is Everything

This article from Terrance DeJesus and Bryan Porras lays out a plan-first methodology for cloud threat emulation aimed at detection engineering. The core argument is straightforward: cloud TE/DE needs its own discipline, not a port of endpoint testing habits.

Core methodology
The proposed lifecycle has five stages:
1. Scope in layers (atomic, micro, full)
2. Threat model including victim environment
3. Execute from a compromised identity
4. Verify telemetry is actually useful for detection
5. Tear down clean

Why cloud is different
Endpoint atomic testing can get away with a host and a payload. Cloud cannot. Identities, control-plane APIs, eventual consistency, and logging that ships half-off change what reproducing a behavior means. There is often no malware sample or sandbox to replay. You research the behavior, model the victim environment, provision resources and identities, execute, and capture telemetry.

Existing tooling
The article references several tools used in practice:
• Stratus Red Team
• Atomic Red Team
• CloudGoat
• ROADTools
• Splunk ATT&CK Range
• Various homegrown scripts

These tools handle the detonation part. The planning, testing, and cleanup around detonation remain largely manual.

Key pitfalls
• Starting from admin sessions and out-of-order API calls produces pretty demos and bad detection data
• Cloud detection is not "call an API, alert on that API" — IAM context, prerequisites, and realistic execution all matter
• Poor emulation produces poor data, which produces poor detections
• Telemetry and coverage are outputs to verify, not assumptions to write rules against

On automation
Automation removes repetitive work. Engineers still own realism and assumptions, plus the decision of whether a detection is worth shipping.

This is Part 1 of a series. Part 2 will cover agents, skills, and AI executing the methodology in practice.

🔹 cloudsecurity #detectionengineering #threatemulation #mitreattack #cloudsec

🔗 Source: https://www.elastic.co/security-labs/threat-command/cloud-threat-emulation-methodology

----------------

🛠️ Tool
===================

Cloud Threat Emulation on Autopilot: Context is Everything

This article from Terrance DeJesus and Bryan Porras lays out a plan-first methodology for cloud threat emulation aimed at detection engineering. The core argument is straightforward: cloud TE/DE needs its own discipline, not a port of endpoint testing habits.

Core methodology
The proposed lifecycle has five stages:
1. Scope in layers (atomic, micro, full)
2. Threat model including victim environment
3. Execute from a compromised identity
4. Verify telemetry is actually useful for detection
5. Tear down clean

Why cloud is different
Endpoint atomic testing can get away with a host and a payload. Cloud cannot. Identities, control-plane APIs, eventual consistency, and logging that ships half-off change what reproducing a behavior means. There is often no malware sample or sandbox to replay. You research the behavior, model the victim environment, provision resources and identities, execute, and capture telemetry.

Existing tooling
The article references several tools used in practice:
• Stratus Red Team
• Atomic Red Team
• CloudGoat
• ROADTools
• Splunk ATT&CK Range
• Various homegrown scripts

These tools handle the detonation part. The planning, testing, and cleanup around detonation remain largely manual.

Key pitfalls
• Starting from admin sessions and out-of-order API calls produces pretty demos and bad detection data
• Cloud detection is not "call an API, alert on that API" — IAM context, prerequisites, and realistic execution all matter
• Poor emulation produces poor data, which produces poor detections
• Telemetry and coverage are outputs to verify, not assumptions to write rules against

On automation
Automation removes repetitive work. Engineers still own realism and assumptions, plus the decision of whether a detection is worth shipping.

This is Part 1 of a series. Part 2 will cover agents, skills, and AI executing the methodology in practice.

🔹 cloudsecurity #detectionengineering #threatemulation #mitreattack #cloudsec

🔗 Source: https://www.elastic.co/security-labs/threat-command/cloud-threat-emulation-methodology