Threat intelligence & cloud

Connect cloud evidence to adversary behaviour - for CTI analysts structuring findings and responders turning observations into intelligence.

Who this is for

DFIR analysts

Record findings in a structured, shareable way and know which log proves which action.

Threat intelligence analysts

Map cloud telemetry onto the Diamond Model and MITRE ATT&CK, and track how threat actors abuse cloud services.

The Diamond Model in the cloud

Cloud shifts what populates each vertex - most observable evidence lives in identity and control-plane logs.

Vertex	What it is	Where you see it in cloud
Adversary	Actor and intent	Inferred from source identity, behaviour, tooling, and campaign overlap.
Capability	Techniques and tooling	API calls in control-plane logs, OAuth grants, role changes, malicious images - maps to ATT&CK Cloud.
Infrastructure	What they operate from/through	Source IPs/ASNs and user-agents in sign-in and flow logs, federated IdPs, attacker-created roles/keys, exfil destinations.
Victim	Targeted identities and assets	Compromised principals, affected accounts/subscriptions/projects, data reached.

How threat actors abuse the cloud

Identity-first intrusion

Valid accounts via phishing, credential theft, or MFA fatigue; activity then looks like normal API calls. T1078.004

OAuth & app-integration persistence

Consent-grant abuse and malicious apps that survive password resets. T1550.001 T1528

Federation & trust abuse

Attacker IdP trust, token/SAML forgery, cross-account role assumption. T1606.002 T1484.002

Resource hijacking

Cryptomining and stolen-key resale, first seen as cost anomalies. T1496

Data exfil from storage

Mass object reads, often invisible without data-plane logging. T1530 T1567

Defense evasion

Disabling logging, deleting trails/sinks, unused regions. T1562.008

Turning findings into intelligence

For each action, capture the ATT&CK technique + the evidencing log + the identity/infrastructure involved; assemble Diamond events along the timeline; note collection gaps; extract indicators and behaviours; feed it back into detections and logging defaults.

For current attributed activity, pair this with primary reporting and the ATT&CK Groups and Campaigns pages - cloud actors and techniques change quickly. See each provider page for historical incidents.