Lesson 13 — Cloud Kill Chain

Learning Objectives

By the end of this lesson, you will be able to:

Understand the Cloud Kill Chain.
Learn how attackers progress through cloud environments.
Map attack stages across AWS, Azure, Google Cloud and Kubernetes.
Identify attacker objectives at every phase.
Understand enterprise detection opportunities.
Apply the Cloud Kill Chain during cloud penetration testing.

Introduction

Modern cloud attacks rarely happen in a single step.

Instead, attackers move through a series of stages, gradually expanding their access until they reach valuable business assets.

This sequence of activities is known as the Cloud Kill Chain.

Understanding the kill chain helps Cloud Penetration Testers:

Think like attackers.
Identify attack paths.
Validate security controls.
Prioritise remediation.
Improve detection capabilities.

What is the Cloud Kill Chain?

The Cloud Kill Chain is a framework describing the stages attackers follow during a cloud compromise.

Unlike traditional environments, cloud attacks focus heavily on:

Identity
Cloud APIs
Kubernetes
Storage
Workload identities
Automation

Each stage provides opportunities for defenders to detect or stop an attack.

Enterprise Cloud Kill Chain

Reconnaissance

↓

Initial Access

↓

Credential Access

↓

Cloud Enumeration

↓

Privilege Escalation

↓

Persistence

↓

Lateral Movement

↓

Resource Discovery

↓

Data Access

↓

Data Exfiltration

↓

Impact

Phase 1 — Reconnaissance

Attackers gather intelligence before launching an attack.

Typical activities include:

Domain discovery
Cloud provider identification
Public repository searches
DNS enumeration
API discovery
Employee profiling
Certificate transparency searches

Objective:

Identify attack opportunities.

Phase 2 — Initial Access

Attackers obtain an initial foothold.

Common techniques include:

Phishing
Stolen credentials
Public application exploitation
API abuse
Supply chain compromise
Public storage exposure

Example:

Phishing Email

↓

Developer Credentials

↓

AWS Console Login

Phase 3 — Credential Access

Attackers attempt to collect additional credentials.

Targets include:

IAM Access Keys
OAuth Tokens
Kubernetes Service Account Tokens
Environment Variables
Secrets
Configuration Files
Metadata Service

Credentials enable deeper access into the cloud environment.

Phase 4 — Cloud Enumeration

Attackers enumerate available resources.

Examples:

IAM Users
IAM Roles
Virtual Machines
Storage Buckets
Kubernetes Clusters
APIs
Databases
Serverless Functions

Enumeration helps attackers identify high-value targets.

Phase 5 — Privilege Escalation

Attackers attempt to obtain greater permissions.

Examples:

Assume IAM Roles
Modify IAM Policies
Abuse RBAC
Escalate Linux Privileges
Compromise Administrator Accounts

Example:

Developer Role

↓

AssumeRole()

↓

Administrator

↓

Full Cloud Control

Phase 6 — Persistence

Attackers establish long-term access.

Methods include:

New IAM Users
New Access Keys
Backdoor Service Accounts
Scheduled Tasks
Malicious Containers
Startup Scripts

Persistence allows attackers to return after passwords are changed.

Phase 7 — Lateral Movement

Attackers move between cloud resources.

Examples:

EC2

↓

IAM Role

↓

Amazon S3

↓

Amazon EKS

↓

Database

Other examples:

Kubernetes to Cloud IAM
Container to Host
API to Storage
CI/CD to Production

Phase 8 — Resource Discovery

Attackers identify valuable assets.

Examples include:

Customer databases
Financial records
Storage buckets
Secrets Manager
Kubernetes Secrets
CI/CD pipelines
Backup repositories

Objective:

Locate sensitive business assets.

Phase 9 — Data Access

Once valuable resources are identified, attackers access sensitive information.

Potential targets:

Customer records
Source code
Intellectual property
Personally Identifiable Information (PII)
Financial information
Encryption keys

Phase 10 — Data Exfiltration

Attackers transfer data outside the organisation.

Examples:

Storage downloads
API exports
Database dumps
Backup extraction
Encrypted outbound traffic

Data theft is one of the most common objectives of cloud attacks.

Phase 11 — Impact

The final phase depends on attacker objectives.

Possible outcomes:

Data theft
Ransomware
Cryptocurrency mining
Business disruption
Service destruction
Infrastructure deletion
Supply chain compromise

Enterprise Attack Flow

Internet

↓

Phishing

↓

Cloud Identity

↓

IAM Enumeration

↓

Privilege Escalation

↓

Amazon EKS

↓

Service Account

↓

Amazon S3

↓

Customer Database

↓

Data Exfiltration

Cloud Kill Chain vs Traditional Kill Chain

Traditional Infrastructure	Cloud Infrastructure
Malware Delivery	Credential Theft
Host Exploitation	Identity Compromise
Local Admin	IAM Privilege Escalation
Internal Network	Cloud APIs
File Shares	Object Storage
Active Directory	Cloud IAM
Physical Servers	Cloud-native Services

Cloud attacks focus far more on identities and APIs than physical systems.

MITRE ATT&CK Mapping

Kill Chain Phase	Example MITRE ATT&CK Technique
Reconnaissance	Gather Victim Identity Information
Initial Access	Valid Accounts
Credential Access	Credentials from Password Stores
Discovery	Cloud Service Discovery
Privilege Escalation	Additional Cloud Roles
Persistence	Create Cloud Account
Lateral Movement	Cloud Service Access
Collection	Data from Cloud Storage
Exfiltration	Exfiltration to Cloud Storage
Impact	Data Encrypted for Impact

Using the kill chain alongside MITRE ATT&CK provides a structured approach to analysing cloud attacks.

Cloud Penetration Testing Perspective

During an assessment, ask:

Can an attacker obtain initial access?
Can they enumerate cloud resources?
Can they escalate privileges?
Can they move laterally?
Can they access Kubernetes?
Can they reach sensitive storage?
Would security monitoring detect these activities?

These questions help identify realistic attack paths.

Enterprise Scenario

CloudNova Technologies operates:

AWS
Azure
Amazon EKS
Azure Kubernetes Service (AKS)
GitHub Enterprise
Jenkins CI/CD

Assessment findings:

Developer credentials exposed in Git.
IAM role with administrator permissions.
Public Amazon S3 bucket.
Over-privileged Kubernetes service accounts.
Weak Network Policies.
No runtime monitoring.

Attack chain:

Git Repository

↓

Credentials

↓

AWS IAM

↓

Administrator Role

↓

Amazon EKS

↓

Secrets

↓

Amazon S3

↓

Customer Records

This illustrates how multiple weaknesses can be chained together into a complete enterprise compromise.

Detection Opportunities

Every phase provides opportunities for defenders.

Attack Phase	Detection Opportunity
Reconnaissance	Threat Intelligence & Web Monitoring
Initial Access	MFA Alerts
Credential Access	Secret Scanning
Enumeration	CloudTrail API Monitoring
Privilege Escalation	IAM Change Alerts
Persistence	Identity Monitoring
Lateral Movement	Network Monitoring
Resource Discovery	API Analytics
Data Access	Database Activity Monitoring
Data Exfiltration	DLP & Network Monitoring

Defensive Controls

Organizations should implement:

Multi-Factor Authentication (MFA)
Least Privilege IAM
Cloud Security Posture Management (CSPM)
Runtime Detection
Network Segmentation
Secret Management
Kubernetes RBAC
Audit Logging
Continuous Monitoring
Incident Response Automation

Breaking the kill chain early significantly reduces business impact.

Best Practices

Focus on identity security first.
Monitor cloud API activity.
Secure Kubernetes workloads.
Enable audit logging.
Rotate credentials regularly.
Review IAM permissions frequently.
Secure CI/CD pipelines.
Protect cloud storage.
Continuously assess attack paths.

Common Mistakes

Avoid:

Assuming cloud providers secure customer configurations.
Ignoring workload identities.
Leaving public storage accessible.
Granting excessive IAM permissions.
Failing to monitor cloud APIs.
Ignoring Kubernetes security.
Treating vulnerabilities independently instead of analysing attack chains.

Knowledge Check

1. What is the Cloud Kill Chain?

Answer: The Cloud Kill Chain is a structured framework that describes the stages attackers follow when compromising cloud environments, from reconnaissance to business impact.

2. Why is privilege escalation a critical phase?

Answer: Privilege escalation allows attackers to gain broader permissions, enabling access to additional cloud resources, sensitive data and administrative capabilities.

3. Why should organisations map attack paths instead of reviewing individual vulnerabilities?

Answer: Attack path analysis shows how multiple weaknesses can be combined into a complete compromise, helping organisations prioritise remediation based on real business risk.

4. Which phase provides the greatest opportunity to stop an attacker?

Answer: Every phase offers detection opportunities, but preventing or detecting attacks during initial access, credential access or privilege escalation often prevents the attacker from reaching sensitive resources.

5. How does understanding the Cloud Kill Chain help Cloud Penetration Testers?

Answer: It enables testers to evaluate cloud environments from an attacker’s perspective, identify realistic attack paths and recommend controls that interrupt the attack before significant business impact occurs.

Key Takeaways

Cloud attacks follow a predictable progression from reconnaissance to impact.
Identity compromise and privilege escalation are central to most cloud attack chains.
Kubernetes, APIs, cloud storage and workload identities are common targets.
Attack path analysis is more valuable than evaluating isolated vulnerabilities.
Defenders should implement layered controls that disrupt attackers at every phase of the Cloud Kill Chain.

What’s Next?

In the next lesson, we will explore Lesson 14 — Cloud Pentester Day in the Life, where you will learn how professional Cloud Penetration Testers prepare for engagements, conduct enterprise assessments, collaborate with stakeholders and deliver actionable security reports.

➡️ Next Lesson: Lesson 14 — Cloud Pentester Day in the Life