Cloud-Conscious Tactics, Techniques, and Procedures (TTPs)

Cloud-Conscious vs Cloud-Agnostic Actors

CrowdStrike cloud threat intelligence analyst Sebastian Walla distinguishes actors who treat cloud VMs as generic hosts from cloud-conscious adversaries who abuse control planes, billing, and cloud-native services for greater impact. Cloud-conscious cases more than doubled between 2022 and 2023 in CrowdStrike IR and managed hunting data from real victims.

Prevalent Techniques Heat Map

A MITRE ATT&CK heat map highlights identity-centric patterns: valid credentials often start intrusions with unclear origin, plus phishing and public-application exploitation. Remote-service scanning accounts for only ~5%—lower than honeypot-driven public reporting suggests. Actors reset or bypass MFA, create accounts, and frequently already hold highly privileged credentials.

Defense Evasion and Movement

Cloud-conscious intruders modify firewalls, disable GuardDuty or similar tooling, and alter logging configurations. They hunt credentials in files, instance metadata, and credential stores, then move laterally via SSH/RDP or from workloads into cloud control planes and back. Walla provides hunting leads per technique for prioritizing defenses.