Interactive

Cloud Attack Path — Guided Playbook

On-prem AD map ↗

Work it top‑to‑bottom: click an access stage to expand it, click a technique for its theory link and commands, and follow the coloured Move to pivots as your access moves across Entra ID, Azure, AWS and Kubernetes.

How to use this map
  • Sections are stages, colour‑coded by platform and access. Start at the top (Unauthenticated Recon) and work down as you gain identity — Entra/Azure is violet, AWS is cyan, Kubernetes is teal.
  • Click a section to expand it, then click a technique for its commands. Every command block has a copy button. Commands are enumeration/mechanism references, not a turnkey kit.
  • A technique carries a Theory chip (opens the deep-dive page) and sometimes a red shield chip (its Vulns & Misconfigs entry).
  • “Move to” rows are coloured to the stage they jump to — follow them when your access changes (e.g. a stolen IMDS role → AWS Privilege Escalation). Dashed grey tags are end states.
  • Use Expand all / Collapse all below. Collapsing a section also closes its techniques, so it reopens clean.
  • Link straight to a spot by adding #section or #section/technique to the URL.