AWS Community Day Indonesia 2025 - Attack the Cloud Before Attackers Do Building Adversary Simulation Playbooks.pdf

Many cloud breaches come from simple mistakes like misconfigurations, overly broad permissions, or skipping breach simulations. Attackers use gaps like these to their advantage, abusing Cloud Service Provider (CSP) features to steal data, move between accounts, or stay hidden. In this session, we will walk through real scenarios that often get overlooked and show how AWS features can be turned against you for data exfiltration, lateral movement, and other risks. We will also run a live demo with Stratus Red Team to show how these attacks look in practice. Along the way, we’ll build playbooks that let you repeat the simulations, test your defenses, and spot weak points. By the end, you will have a clear idea of how to run adversary simulations in your own cloud setup and reduce the attack surface before real attackers do!

1. Attack the Cloud Before Attackers Do:
Building Adversary Simulation Playbooks
Muhammad Yuga Nugraha, Satria Ady Pradana

2. Who We Are
•DevSecOps Engineer at Practical DevSecOps.
•Not locked into any cloud vendor, I love working with any cloud.
•Speaker at PyCon APAC 2024, PyCon SG 25, AWS Community
Day Indonesia 2024, KCD Indonesia 2024, OpenInfraDays ID
2025, Cloud Village @ DEFCON 33.
M. Yuga Nugraha

3. Who We Are
•Adversarial Engineer at Grab.
•Community Leader of Reversing.ID.
•Malware analyst and developer in free time.
Satria Ady Pradana

5. Cloud Incidents - Uber Breach

7. Cloud Incidents - Capital One Breach

9. What is Red Team?
Simulating Tactics, Techniques, and Procedures (TTPs) used by adversaries or
threat actors within controlled environment to evaluate the security posture of the
organization.

10. Phases of Engagement

11. •Emulated attacks must be performed in repeatable, consumable and
actionable way.
•Predictable outcome and side effects.
•Action should improve detection.
Do it X times!

12. MITRE ATT&CK Cloud Matrix

13. DataDog - Cloud Security Atlas

14. So, where do we begin?

15. •Define scope and objectives
•Rules of engagement
•Prepare isolated test environment (use production)
•Monitor, document, and remediate
Getting Started

16. What about the tooling?

18. WARM
Spin up infrastructure
DETONATE
Execute the attack
REVERT
Revert to a detonatable state
CLEANUP
Remove all infrastructure
State Machine

19. Installation

21. Credential Access (5), Defense Evasion (7), Discovery (3), Execution (4), Exfiltration
(5), Impact (4), Lateral Movement (2), Persistence (10), Privilege Escalation (7)

22. Organised by platform and tactic using the following pattern.
PLATFORM [.] TACTIC [.] TECHNIQUE
Example: aws.credential-access.ec2-get-password-data
Attack Techniques

24. Case: Credential Access
https://attack.mitre.org/tactics/TA0006/

25. Warmup

26. Detonate

28. Malicious activity?

29. CloudTrail Events

30. Nice catch!

31. Cleanup

32. Case: Discovery
https://attack.mitre.org/tactics/TA0007/

33. Warmup

34. Detonate

35. Nice catch!

36. AWS CloudTrail
????

37. What happened?

38. Nice catch!
AWS Systems Manager

39. Nice catch!

40. No finding in GuardDuty, what happened?

45. Create a New Scenario

46. https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-
credential-exfiltration-paths-in-aws-code-interpreters/

49. Amazon Bedrock AgentCore Code Interpreter

50. •Create an S3 bucket with a sample customer data file (customer.csv).
•Create an IAM role with S3 read permissions for Bedrock Agent Core
service.
•Create a Bedrock Code Interpreter with the execution role.
aws.exfiltration.s3-bedrock - Warmup

51. •Start a Bedrock Code Interpreter session.
•Execute a command to query the EC2 instance metadata service (IMDS).
•Retrieve temporary security credentials from Bedrock Code Interpreter.
•These credentials can be used to access the S3 bucket and exfiltrate data
(GetObject, PutObject)
aws.exfiltration.s3-bedrock - Detonation

52. Register New Attack

53. Case: Exfiltration
https://attack.mitre.org/tactics/TA0010/

54. Warmup

55. Detonate

57. Thank you