Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Hunting For Living Off The Cloud Techniques · mukul975 | DecimalAI

Hunting For Living Off The Cloud Techniques

SkillScore36Maintained

hunting-for-living-off-the-cloud-techniques

Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse of Azure, AWS, GCP services, and SaaS platforms.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md

decimalai skills pull hunting-for-living-off-the-cloud-techniques --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-living-off-the-cloud-techniques/SKILL.md https://app.decimal.ai/s/hunting-for-living-off-the-cloud-techniques/SKILL.md

Raw file: /s/hunting-for-living-off-the-cloud-techniques/SKILL.md ↗ · machine-readable summary at /s/hunting-for-living-off-the-cloud-techniques.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +32% lift+6% tokens0% turns36% of whole cases pass with skill (8/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-17	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-02	✗→✓	▲ Improved	—	—
case-04	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-living-off-the-cloud-techniques/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Hunting For Living Off The Cloud Techniques

When to Use

When proactively hunting for indicators of hunting for living off the cloud techniques in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

| Concept | Description | |---------|-------------| | T1102 | Web Service | | T1567 | Exfiltration Over Web Service | | T1537 | Transfer Data to Cloud Account |

Tools & Systems

| Tool | Purpose | |------|---------| | CrowdStrike Falcon | EDR telemetry and threat detection | | Microsoft Defender for Endpoint | Advanced hunting with KQL | | Splunk Enterprise | SIEM log analysis with SPL queries | | Elastic Security | Detection rules and investigation timeline | | Sysmon | Detailed Windows event monitoring | | Velociraptor | Endpoint artifact collection and hunting | | Sigma Rules | Cross-platform detection rule format |

Common Scenarios

Scenario 1: C2 over Discord webhooks for command delivery
Scenario 2: Data exfiltration to Telegram bot API
Scenario 3: Malware using Azure Functions for dynamic C2
Scenario 4: Staging stolen data on Google Docs or Notion pages

Output Format

Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1102
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]

Illustrative Want to see what hunting-for-living-off-the-cloud-techniques would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 03:12 UTC · 22 cases

Lift

+32%

36% vs 5%

Agent turns

1.0 vs 1.0

Tokens

+6%

1,967.91 vs 1,857.82

fail → pass · 7pass → pass · 1fail → fail · 14

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-15 When classifying the risk level in a living-off-the-cloud hunt output schema, what standardized categorical options are valid for the Risk Level field?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 When attackers use legitimately hosted web services like Pastebin or GitHub Gists for C2 payload delivery, which primary MITRE ATT&CK Enterprise technique ID classifies this behavior?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What specific confidence rating values are permitted in the standard hunt report schema for living-off-the-cloud technique detections?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 After executing hunting queries against SIEM and EDR data and identifying potential cloud service anomalies, what analytical step in the workflow must be performed before validating whether findings are true or false positives?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Detail the 7-step process for executing a threat hunt against cloud service abuse, starting from initial preparation down to final reporting.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Review the following AWS Terraform snippet defining an S3 bucket policy and determine if `s3:GetObject` is exposed to `*` (public access). Provide remediation code for restricting access to a specific IAM Role ARN.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We noticed suspicious outbound network calls to Telegram bot endpoints coming from server PROD-FIN-02 under account domain\jdoe. Conduct a threat hunt for living-off-the-cloud techniques and format the report with the hunt tracking identifier, mapped technique identifier, impacted host and user context, supporting log and process evidence, assessed risk level, confidence score, and recommended action steps.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Threat intelligence indicates an active campaign using Azure Functions for dynamic command delivery, and endpoint WORKSTATION-88 triggered a soft alert. Run a threat hunting investigation into this potential cloud service abuse and summarize the outcome providing a Hunt ID, ATT&CK technique, target host, account context, key evidence, risk level, confidence rating, and containment recommendations.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When an internal host uses cloud storage web services or API endpoints like Telegram or Dropbox to bypass perimeter egress controls and exfiltrate data, what exact MITRE ATT&CK technique ID applies?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 An adversary is utilizing Discord webhooks for command delivery to endpoint DESKTOP-ENG-05 under user dev_user. Provide the hunt report output for this incident, avoiding standard markdown paragraphs.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Analyze this Windows Event ID 4769 log showing a Kerberos service ticket request with RC4 encryption (0x17) for service account `svc_sql`. Detail how to detect Kerberoasting in Active Directory and recommend mitigation steps.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 An organization wants to prepare its enterprise endpoints for hunting cloud-assisted adversary techniques. What Windows log enhancement driver and event monitoring utility provides granular process creation and network connection event data on Windows endpoints?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We are beginning a proactive threat hunt for covert communications over SaaS collaboration tools like Slack and Discord. What is the initial step in the systematic hunting execution workflow prior to identifying data sources or running queries?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our SOC flagged abnormal data transfers directed toward Notion and Google Docs URLs from user account s_smith on HR-LAPTOP-14. Execute a threat hunt for this living-off-the-cloud data exfiltration scenario, returning your findings containing the hunt ID, technique code, affected hostname, user context, gathered telemetry evidence, risk level, confidence score, and suggested mitigation steps.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 A compromised cloud instance transferred 50GB of archived database dumps directly to an external attacker-controlled S3 bucket. Generate the threat hunting report summary for this cloud-to-cloud data movement scenario.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Our security team wants to write threat detection rules for cloud service exfiltration that can be translated and deployed across both Splunk SPL and Microsoft Defender KQL. Which rule format standard fulfills this cross-platform requirement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 During a cloud service abuse hunt on an endpoint, we need a specialized open-source forensic tool capable of digital forensics and endpoint artifact collection across multiple hosts. Which tool fulfills this endpoint artifact gathering role?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 What query language is used within Microsoft Defender for Endpoint to perform advanced threat hunting queries for process and network events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An analyst generated a threat hunt finding for C2 activity via Azure Functions on host FINANCE-SRV-01. When outputting the structured hunt summary block, what exact field header label is used for the affected endpoint name?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Threat actor activity reveals sensitive financial data being staged on Notion web pages prior to exfiltration. What ATT&CK technique code covers exfiltrating data over such web services?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Submit a threat hunt report for suspicious Slack API exfiltration detected on host WS-102 by user corp\jdoe. Format the response strictly using the standardized key-value block starting with Hunt ID and ending with Recommended Action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We are configuring a GitHub Actions workflow to scan Python source code for hardcoded secrets and SQL injection vulnerabilities using Semgrep. Provide a GitHub Actions YAML workflow step that runs Semgrep on pull requests.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 36.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 03:12 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run36

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-47% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Hunting For Living Off The Cloud Techniques

SkillSafety

Source

Hunting For Living Off The Cloud Techniques

When to Use

Prerequisites

Workflow

Key Concepts

Tools & Systems

Common Scenarios

Output Format

How this skill was measured

Related skills