skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-living-off-the-cloud-techniques

Detect adversary abuse of legitimate cloud and SaaS services for C2 and exfiltration.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#exfiltration#siem#mitre attack#saaS#c2 detection#cloud abuse
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-living-off-the-cloud-techniques
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-living-off-the-cloud-techniques
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-living-off-the-cloud-techniques
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-living-off-the-cloud-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers increasingly route command-and-control and data exfiltration through trusted cloud and SaaS platforms like Discord, Telegram, Microsoft Graph, and Google Drive, which defeats reputation-based detection. This Skill provides a structured threat-hunting workflow to surface that abuse using EDR and SIEM telemetry.

Core Features & Use Cases

  • Hypothesis-Driven Hunting: A seven-step workflow from hypothesis formulation through query execution, validation, and reporting mapped to MITRE ATT&CK techniques T1102, T1567, and T1537.
  • Detection Gap Guidance: Explains why domain reputation fails against SaaS-based C2 and directs analysts toward beacon-timing analysis, JA3/JARM fingerprinting, and per-user traffic baselining.
  • Use Case: After threat intelligence reports a campaign using Telegram bots for exfiltration, run the hunt to query proxy and EDR telemetry for periodic connections to api.telegram.org, validate with a simulated exfiltration test, and document findings in the standardized hunt output format.

Quick Start

Hunt for evidence of living-off-the-cloud C2 or exfiltration over SaaS platforms like Discord, Telegram, or Azure Functions using our EDR and SIEM telemetry.

Frequently Asked Questions about hunting-for-living-off-the-cloud-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect C2 traffic over legitimate SaaS platforms?▼

Detect SaaS-based C2 by analyzing beacon timing and periodicity rather than domain reputation, since services like Discord, Telegram, and Microsoft Graph are already trusted. Use JA3/JARM fingerprinting and baseline per-user traffic volumes to flag deviations.

What tools are needed for living-off-the-cloud threat hunting?▼

The hunt requires an EDR platform with process and network telemetry such as CrowdStrike, MDE, or SentinelOne, plus a SIEM like Splunk, Elastic, or Sentinel. Sysmon, Velociraptor, and Sigma rules support endpoint collection and detection logic.

Why does domain reputation detection fail against cloud C2?▼

Reputation-based detection fails because C2 over trusted SaaS terminates at high-reputation domains already on corporate allowlists. OAuth and refresh-token abuse also leaves no malware on disk, making the access look like a normal API client.

How do I validate that my cloud abuse hunt actually works?▼

Validate the hunt by simulating exfiltration to a Telegram bot or a Microsoft Graph API upload, then confirming that EDR and proxy telemetry plus your beacon-detection logic flag the periodic SaaS traffic. This proves the detection fires before a real incident.

How do I reduce false positives when hunting SaaS exfiltration?▼

Reduce false positives by baselining normal per-user and per-host destinations and data volumes for the same SaaS services, then alerting on deviation rather than the service itself. Legitimate corporate use of these platforms is expected.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
allanninalallanninal
1

threat-hunting

Apply Sigma detection rules to investigate security incidents.

Community
Advanced
Liberty91LTDLiberty91LTD
15

threat-actor-profiling

Organize threat actor intelligence into update-ready profiles with MITRE ATT&CK mappings.

Official
Advanced
Cogni-AI-OUCogni-AI-OU
3

gh-aw-firewall-debug

Debug AWF firewall egress blocks via Docker, Squid logs, and iptables.

Official
Intermediate