This content is open to everyone — sign in to save your progress, earn points, and unlock module exams.

Topic 2.7 of Cloud Threats and Attack Vectors

APT Techniques & Lateral Movement in Cloud

How APT groups exploit cloud-native services for initial access, privilege escalation, lateral movement across accounts, and data exfiltration.

~35 min total·4 quadrants of structured content

By the end of this topic, you will

Map APT techniques to the MITRE ATT&CK for Cloud matrix
Explain two IAM privilege escalation paths exploiting iam:PassRole
Describe cross-account role chaining and the conditions that enable it
Identify the eight CloudTrail events that should trigger near-real-time alerts

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Quadrant 2 · e-Content

Articles and case studies

cloud-security

Advanced Persistent Threats & Lateral Movement in Cloud Environments

APT groups have adapted their techniques for cloud infrastructure. This article examines the cloud APT kill chain — from initial access through privilege escalation, lateral movement across accounts, and data exfiltration — with detection patterns for each stage.

22 min read

Quadrant 3 · Web Resources