Cloud Threat-Hunting Lab · Hacking Project

Provide a safe, reproducible environment that generates authentic cloud attack telemetry so learners can practice hypothesis-driven threat hunting against real TTPs.

**The problem**
Threat hunters need a safe, realistic cloud environment to practice hunting adversary behavior, yet most training is on-prem or theoretical and never touches real cloud telemetry, IAM abuse, or serverless attack paths. Without a purpose-built lab that generates authentic attack data, analysts cannot develop hypotheses, validate detections, or build muscle memory for cloud-native TTPs. This gap leaves SOCs underprepared for the cloud attacks they now face daily.

**What you'll build**
Build a reproducible cloud threat-hunting lab: vulnerable-by-design cloud infrastructure (Terraform-provisioned), an attack-emulation layer (Stratus Red Team, Atomic Red Team, Leonidas, CloudGoat) that generates realistic ATT&CK Cloud telemetry, and a hunting workbench (log lake + notebooks) where students form and test hypotheses. Include guided hunt playbooks mapped to ATT&CK/D3FEND and teardown automation so the lab is disposable and cost-controlled.

**Objective** — Provide a safe, reproducible environment that generates authentic cloud attack telemetry so learners can practice hypothesis-driven threat hunting against real TTPs.

**Expected outcome** — A Terraform-deployable lab plus documented hunt playbooks where a student emulates a cloud attack and demonstrably hunts it down from the collected telemetry.

**Difficulty** — Advanced — combines cloud provisioning, adversary emulation, telemetry engineering, and analytic hunting into one integrated build.

**Primary category** — Threat Hunting; Secondary = Purple Team, Cloud Security, Detection Engineering

**Security domains** — Primary = Threat Hunting; Secondary = Purple Team, Cloud Security, Blue Team, Threat Intelligence, Incident Response

**Technical focus** — Adversary emulation, hypothesis-driven hunting, cloud telemetry analysis, IAM/serverless attack paths, ATT&CK mapping, detection validation, log lake analytics, lab automation/teardown, purple-team exercises

**Core technologies** — Languages: Python, HCL/Terraform, SQL, Bash; Frameworks/Libraries: Stratus Red Team, Atomic Red Team, CloudGoat, Leonidas, MITRE ATT&CK/Navigator, Jupyter; Security Tools: CloudTrail/Athena, GuardDuty, Wazuh, OpenSearch/ELK, Sigma; Cloud/Infra: AWS (primary), Azure/GCP optional, Kubernetes; AI/Data: anomaly detection, notebook-based analytics; Databases: Athena/OpenSearch/ClickHouse

**Where it's valued** — MSSPs/MDR, enterprise SOCs, cloud security teams, training/EduTech providers, threat-intel teams

**Careers it builds toward** — Threat Hunter, Purple Team Engineer, Detection Engineer, Cloud SOC Analyst, Incident Responder, Security Researcher

**Framework alignment**
• MITRE ATT&CK: Valid Accounts: Cloud Accounts T1078.004, Account Manipulation T1098 (T1098.001 Additional Cloud Credentials, T1098.003 Additional Cloud Roles), Cloud Service Discovery T1526, Cloud Infrastructure Discovery T1580, Unsecured Credentials T1552, Data from Cloud Storage T1530, Exfiltration to Cloud Storage T1567.002, Cloud Administration Command T1651
• NIST CSF 2.0: Detect (primary), Identify, Respond
• OWASP: N/A (infrastructure/telemetry focus)
• CIS Controls v8: 8 Audit Log Management, 13 Network Monitoring & Defense, 17 Incident Response Management, 18 Penetration Testing

**Innovation** — Research-Level Project — an integrated, disposable cloud hunting range with emulation-to-detection loops is genuinely valuable for training and detection R&D. Scores: Innovation 7/10, Startup 6/10, Enterprise-Readiness 7/10, Patent = No.