Six chains. Every step published, audited, reproducible.
Each scenario is a Pulumi stack, a peer-reviewed boto3 module, and a runnable chain. We publish the technique map, the CloudTrail it produces, and the detection rule that should catch it.
AttachRolePolicy chain
A leaked IAM user assumes a role that holds iam:AttachRolePolicy on itself, then attaches AdministratorAccess. One of the most-seen privilege paths in real breach forensics.
KMS-imported ransomware
Create a new KMS key with external key material, re-encrypt every object in a bucket with it, then drop the import. The data is technically intact and absolutely unreadable. CISA put out an alert in 2024.
S3 enumeration & exfiltration
List every bucket, identify the readable ones, sweep GetObject with parallel sessions, exfiltrate to an attacker-controlled bucket in a different region. Matches the Capital One IR pattern.
IAM eventual consistency window
An access key is revoked, but IAM propagation takes seconds-to-minutes. We race the window - open a session before revocation lands, run a chain of mutations before the cached creds invalidate. Disclosed 2020, still works.
Service permission mapping
A precursor, not a payload. We sweep iam:SimulatePrincipalPolicy across IAM / EC2 / Lambda / RDS / KMS to enumerate exactly which actions a stolen identity can call. Cheap, quiet, hugely valuable to an attacker.
CloudTrail blind-spot abuse
Not every API call lands in CloudTrail. We chain a quiet read (e.g. sts:GetCallerIdentity) into a non-logged action, then resume normal traffic. The chain is invisible to log-only detections.
Have a chain we should ship next?
The catalogue is community-driven. Open an RFC on GitHub or email [email protected].