Runbook 01 — Cloud Red Team Methodology

Runbook Information

Property	Value
Runbook Name	Cloud Red Team Methodology
Module	Module 08 — Cloud Red Team Operations
Runbook Number	Runbook 01
Difficulty	Advanced
Estimated Execution Time	Multi-day Engagement
Audience	Cloud Red Team Operators, Cloud Penetration Testers, Security Consultants
Objective	Provide a repeatable methodology for conducting professional Cloud Red Team engagements from planning through executive reporting and engagement closure.

Purpose

Professional Cloud Red Team engagements are not simply penetration tests.

They are structured, objective-driven assessments that safely emulate realistic cloud adversaries to evaluate an organization’s ability to:

Prevent attacks
Detect malicious activity
Investigate incidents
Contain threats
Recover from compromise
Improve cloud security maturity

This runbook provides the standard operating methodology used throughout GoHackersCloud engagements.

Engagement Lifecycle

Business Objectives

↓

Threat Modelling

↓

Rules of Engagement

↓

Planning

↓

Reconnaissance

↓

Identity Assessment

↓

Privilege Escalation

↓

Lateral Movement

↓

Persistence Assessment

↓

Cloud Communication Validation

↓

Business Impact Validation

↓

Detection Validation

↓

Purple Team Collaboration

↓

Executive Reporting

↓

Remediation

↓

Retesting

↓

Engagement Closure

Phase 01 — Engagement Planning

Objective

Understand why the engagement is being performed.

Activities

Meet executive stakeholders
Define business objectives
Understand critical applications
Identify cloud platforms
Review previous assessments
Review compliance requirements
Establish success criteria

Outputs

Business Objectives
Engagement Charter
Threat Model
Stakeholder Register

Phase 02 — Rules of Engagement

Objective

Define clear operational boundaries.

Include

Scope
Out-of-scope assets
Approved operators
Testing windows
Communication channels
Emergency contacts
Stop conditions
Evidence handling
Data protection requirements
Cleanup expectations

Decision Gate

Proceed only after formal written approval.

Phase 03 — Threat Modelling

Objective

Select realistic cloud adversary scenarios.

Review

Threat intelligence
Industry attack trends
MITRE ATT&CK
Cloud attack techniques
Business risks
High-value assets

Deliverables

Threat Model
Adversary Profile
Attack Objectives

Phase 04 — Reconnaissance

Objective

Identify publicly accessible cloud assets.

Assess

Domains
DNS
APIs
Storage
Identity portals
Cloud services
Serverless endpoints
Kubernetes endpoints
CI/CD services

Deliverables

External Attack Surface Inventory
Cloud Footprint Map
Public Asset Register

Phase 05 — Cloud Identity Assessment

Objective

Understand identity relationships.

Review

AWS IAM
Microsoft Entra ID
Google Cloud IAM
Service Accounts
Managed Identities
Service Principals
Kubernetes Service Accounts
CI/CD identities

Identify

Excessive permissions
Trust relationships
Role assumptions
Federation
Workload identities

Deliverables

Identity Inventory
Permission Matrix
Trust Relationship Diagram

Phase 06 — Privilege Escalation Assessment

Objective

Validate approved privilege escalation paths.

Review

AssumeRole
PassRole
Policy modifications
Managed Identity assignments
Service Account impersonation
Kubernetes RBAC
CI/CD execution roles

Validation

Only approved identities and synthetic resources.

Deliverables

Privilege Escalation Matrix
Identity Attack Graph
Technical Findings

Phase 07 — Lateral Movement Assessment

Objective

Validate movement between trusted cloud resources.

Review

Cross-account trust
Cross-subscription access
Cross-project access
Kubernetes namespaces
Serverless execution identities
CI/CD trust relationships

Deliverables

Attack Path Diagram
Segmentation Assessment
Trust Validation Report

Phase 08 — Persistence Assessment

Objective

Assess approved persistence opportunities.

Review

IAM roles
Scheduled functions
Kubernetes CronJobs
EventBridge
Azure Automation
Cloud Scheduler
CI/CD pipelines

Requirements

Temporary
Approved
Documented
Fully reversible

Deliverables

Persistence Assessment
Cleanup Plan

Phase 09 — Cloud Communication Validation

Objective

Validate cloud-native communication paths.

Review

Amazon SQS
SNS
EventBridge
Azure Service Bus
Event Grid
Google Pub/Sub
Cloud Scheduler

Validate

Logging
Detection
Visibility
Alerting

Deliverables

Communication Assessment
Detection Summary

Phase 10 — Business Impact Validation

Objective

Safely demonstrate business impact.

Approved Assets

Synthetic secrets
Synthetic databases
Test storage
Test APIs
Test applications

Never Use

Real customer data
Production databases
Employee records
Financial systems

Deliverables

Business Impact Assessment
Executive Summary

Phase 11 — Detection Validation

Objective

Measure defensive capability.

Review

CloudTrail
Azure Monitor
Google Cloud Logging
Kubernetes Audit Logs
SIEM
GuardDuty
Microsoft Sentinel
Google SCC

Measure

Logging
Detection
Investigation
Containment

Deliverables

Detection Assessment
SOC Timeline
ATT&CK Mapping

Phase 12 — Purple Team Collaboration

Objective

Improve security controls.

Participants

Red Team
Blue Team
SOC
Cloud Security
DevSecOps
Incident Response

Activities

Review attack path
Validate detections
Tune alerts
Improve playbooks
Retest controls

Deliverables

Purple Team Report
Detection Improvement Register

Phase 13 — Reporting

Executive Report

Include:

Executive Summary
Business Impact
Attack Path
Security Gaps
Recommendations
Roadmap

Technical Report

Include:

Scope
Methodology
Evidence
Findings
ATT&CK Mapping
Risk Register
Technical Recommendations

Deliverables

Executive Report
Technical Report
Executive Presentation
Risk Register

Phase 14 — Remediation Planning

Prioritize

Immediate

Remove excessive permissions
Restrict trust relationships
Enable missing logging

Short Term

Improve IAM
Improve detection
Improve segmentation

Long Term

Zero Trust
Continuous validation
Cloud security governance

Deliverables

Remediation Roadmap
Ownership Matrix

Phase 15 — Retesting

Validate

Fixed findings
Improved detections
Updated IAM
Segmentation improvements

Deliverables

Retest Report

Phase 16 — Engagement Closure

Verify

Temporary identities removed
Temporary permissions removed
Synthetic secrets rotated
Test resources deleted
Sessions revoked
Evidence archived
Customer sign-off received

Deliverables

Cleanup Verification
Engagement Closure Report

Standard Deliverables Checklist

Planning

Technical

Detection

Detection Validation
Purple Team Report
ATT&CK Mapping

Reporting

Closure

Cleanup Verification
Retest Report
Engagement Closure Report

Operational Decision Gates

Phase	Decision
Planning	Executive approval received
Rules of Engagement	Written authorization complete
Reconnaissance	Scope confirmed
Identity Assessment	Approved identities only
Privilege Escalation	Synthetic resources only
Lateral Movement	Trust relationships approved
Persistence	Temporary and reversible
Business Impact	Synthetic assets only
Detection Validation	SOC notified (if required)
Reporting	Technical review completed
Closure	Cleanup verified

Engagement Success Criteria

The engagement is successful when:

Business objectives are achieved.
Rules of Engagement are followed.
Scope is maintained.
No production disruption occurs.
No real data is accessed.
Security controls are evaluated.
Detection capabilities are measured.
Business impact is demonstrated using synthetic assets.
Executive and technical reports are delivered.
Remediation recommendations are prioritized.
Cleanup is verified.
Customer formally accepts the engagement.

Consultant Best Practices

Professional Cloud Red Team consultants should always:

Obtain written authorization before testing.
Understand the customer’s business objectives.
Use the minimum action necessary to validate a finding.
Stay within the approved scope.
Use synthetic identities and data whenever possible.
Preserve evidence throughout the engagement.
Maintain continuous communication with the engagement manager.
Document every major activity and decision.
Recognize security controls that performed well.
Clearly distinguish confirmed findings from theoretical risks.
Provide practical, prioritized remediation guidance.
Verify cleanup before closing the engagement.
Conduct professional executive and technical debriefings.

Common Pitfalls

Avoid the following mistakes:

Beginning testing before authorization.
Testing outside the approved scope.
Using production data for demonstrations.
Failing to document evidence.
Ignoring defensive controls that worked.
Providing overly technical executive reports.
Omitting remediation ownership.
Leaving temporary resources deployed after testing.
Closing the engagement without customer acceptance.

Runbook Summary

This runbook provides the complete operational methodology for conducting professional Cloud Red Team engagements.

Following this methodology ensures that engagements are:

Safe
Repeatable
Evidence-driven
Business-focused
Threat-informed
Professionally documented
Executive-ready
Technically accurate
Aligned with enterprise consulting best practices

By consistently applying this methodology, Cloud Red Team Operators can deliver high-quality assessments that not only identify security weaknesses but also help organizations improve their overall cloud security posture through measurable, actionable, and repeatable security improvements.