Modern Cyberattack Engineering

Supply Chain Attacks, Credential Theft and Cloud Intrusions

Introduction: The Modern Attack Surface

1. What This Book Covers
2. How This Book Is Structured
3. Who Should Read This Book
4. The Principle of Engineering Understanding
5. Scope and Limitations
6. A Note on Citations and Verification
7. The Path Ahead

Chapter 1: Protocol and Architecture Foundations

1. HTTP and HTTPS: TLS mechanics, certificates and downgrade attacks
2. Authentication and Authorization: Kerberos, OAuth/OIDC, SAML, JWT fundamentals
3. Cloud Control Planes and Data Planes: How APIs mediate all cloud operations
4. Container and Kubernetes Architecture: Pods, nodes, CNI, orchestration internals
5. Cryptography for Attackers and Defenders: Key management, PKI, hashing in practice
6. Security Boundaries and Trust Relationships: What “trust” means in modern stacks

Chapter 2: Adversary Tactics, Techniques and the Kill Chain

1. MITRE ATT&CK Mapping: Initial access to exfiltration in modern campaigns
2. Kill Chain Variations: Traditional vs cloud-native vs supply-chain intrusions
3. Attribution and TTPs: Reading adversary behavior from artifacts
4. Blue Team Integration: How red and purple teams use the framework
5. Detection Engineering Fundamentals: Logs, telemetry and hypothesis-driven detection
6. Real Campaign Anatomy: A documented intrusion mapped to ATT&CK

Chapter 3: Package Ecosystems and Dependency Risks

1. npm Ecosystem Mechanics: How npm publishes, resolves and caches packages
2. Python PyPI and pip: Dependency resolution, wheels and environment management
3. Java/Maven, RubyGems and other registries: Architecture and threat models
4. Transitive Dependencies: Why indirect deps dominate the attack surface
5. Lockfiles, Semver and Dependency Pinning: Practices and gaps
6. Case Study: How a single dependency can compromise thousands of projects

Chapter 4: Typosquatting, Dependency Confusion and Package Poisoning

1. Typosquatting: Registering lookalike package names and social dynamics
2. Dependency Confusion: Internal vs public registry priority attacks (Tidepool, PyPI)
3. Subresource Takeover and URL Hijacking: Leveraging broken CNAMEs and redirects
4. Malicious Code Injection: What attackers actually do inside packages
5. Automated Detection: Tools, scanners and monitoring approaches

Chapter 5: Repository and Source Code Compromise

1. GitHub, GitLab, Bitbucket Authentication Models: Personal vs org-level access
2. Compromised Developer Accounts: From credential theft to push access
3. Malicious Pull Requests: Social engineering and automation abuse
4. Webhook and Integration Exploitation: CI triggers and GitHub Actions abuse
5. Git History Attacks: Rewriting history, malicious merge commits
6. Defense: Repository policies, CODEOWNERS, branch protection, SCA

Chapter 6: Build Pipeline and CI/CD Exploitation

1. CI/CD Pipeline Architecture: Triggers, runners, secrets and artifacts
2. GitHub Actions Exploitation: Malicious action workflows and self-hosted runner abuse
3. Jenkins Security: Groovy sandbox escapes, plugin vulnerabilities, credential theft
4. Secrets in Pipelines: Environment variable exposure and log leakage
5. Build System Attacks: Compiler injection, BOM poisoning, Makefile manipulation
6. Defense: Pipeline hardening, runner isolation, secret scanning, signed artifacts

Chapter 7: Code Signing, Attestation and Artifact Security

1. Code Signing Infrastructure: X.509, code-signing certs, cross-platform tools
2. Compromised Signing Keys: How attackers get them (SolarWinds, CCleaner)
3. Supply Chain Attestation: Sigstore, cosign, in-toto, SLSA
4. Binary Analysis and Provenance: Verifying artifact origins
5. Certificate Transparency for Code Signing: Monitoring and detection
6. Defense: Key management, HSMs, short-lived certs, attestation verification

Chapter 8: Authentication Protocols and Credential Mechanics

1. Password Storage: Hashing, salting, rainbow tables and cracking methodologies
2. NTLM and Kerberos: Windows authentication internals
3. Token-Based Authentication: JWT structure, validation and common mistakes
4. Multi-Factor Authentication: OTP, push-based, FIDO2/WebAuthn mechanics
5. OAuth 2.0 Authorization Flows: Authorization code, implicit, client credentials
6. SAML Assertions and Federation: XML-based identity and trust

Chapter 9: Phishing, Harvesting and Social Engineering at Scale

1. Credential Harvesting Pages: Lookalike portals and reverse proxies
2. AD FS and Conditional Access Bypass: How phishing evades protections
3. Evilginx2 and Modern Phishing Proxies: MFA-aware credential theft
4. Email Compromise Chains: From domain spoofing to BEC
5. MFA Fatigue and Prompt Bombing: User-targeted authentication attacks
6. Defense: Phishing-resistant auth, user awareness, email security controls

Chapter 10: Token Theft, Session Hijacking and Cookie Compromise

1. Cookie Attributes and Security: Secure, HttpOnly, SameSite and their limits
2. XSS and Session Theft: From stored XSS to token extraction
3. Token Storage Best Practices: Client-side vs server-side, HTTP-only vs localStorage
4. CSRF and Cross-Origin Attacks: When SameSite fails
5. Browser and OS Token Caches: Credential roaming and credential dumping

Chapter 11: Active Directory and On-Premises Identity Attacks

1. AD Core: Domains, forests, trusts and authentication flows
2. Kerberoasting, AS-REP Roasting and Password Spraying
3. DCSync and Golden Ticket: Domain controller compromise mechanics
4. ACL Abuse and Privilege Escalation: ACE editing, group membership abuse
5. BloodHound and AD Reconnaissance: Graph-based attack path mapping
6. Defense: Hardening, constrained delegation, monitoring, tiering models

Chapter 12: Cloud Identity: Azure AD/Entra ID and IAM Exploitation

1. Entra ID Architecture: Tenants, users, groups, service principals, conditional access
2. Service Principal and App Registration Abuse: Over-permissioned apps
3. OAuth/OIDC Attack Vectors in Azure: Consent phishing, token replay
4. Privileged Identity Management (PIM): Bypass and abuse
5. Cross-Tenant Attacks and Trust: B2B, guest access and federation risks
6. Defense: Least privilege, monitoring sign-in logs, PIM policies, conditional access

Chapter 13: Secrets Management and API Key Compromise

1. Secrets in Source Code: Accidental commits, GitHub exposure, scanning tools
2. Secrets in CI/CD: Environment variables, pipeline artifacts, log leaks
3. Cloud Secrets: AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
4. API Key Leakage: Public repos, configuration files and SaaS integrations
5. Credential Roasting and Token Dumping: From memory and keychain

Chapter 14: AWS Cloud Intrusion: IAM, Metadata and Lateral Movement

1. IAM Mechanics: Policies, roles, users, trust relationships, conditions
2. Over-Privileged Roles and IAM Policy Abuse: Escalation via iam:PassRole, sts:AssumeRole
3. EC2 Instance Metadata Service: IMDSv1 vs IMDSv2, SSRF paths
4. S3 Misconfigurations: Public buckets, ACL attacks, data exfiltration
5. AWS Lambda and Serverless: Privilege escalation, cold-start attacks
6. Defense: SCPs, IAM Access Analyzer, instance metadata hardening, GuardDuty

Chapter 15: Azure Cloud Intrusion: Entra ID, RBAC and Managed Identities

1. Azure RBAC: Role definitions, assignments and scope
2. Managed Identities and User-Assigned Identities: Abuse vectors
3. Azure AD Connect and Hybrid Identity: Compromise bridges between on-prem and cloud
4. Key Vault Exploitation: Access policies, permissions escalation
5. Azure Resource Graph and Control Plane: Reconnaissance techniques
6. Defense: Just-in-time access, PIM, Azure Policy, network segmentation

Chapter 16: Google Cloud Intrusion: IAM, Workload Identity and Kubernetes

1. GCP IAM: Service accounts, roles, organization policies
2. Workload Identity Federation: How it works and abuse scenarios
3. Google Kubernetes Engine (GKE): Node pool attacks, pod identity
4. Cloud Storage and Data Loss: Bucket policies and data exfiltration
5. Service Control Policies and Organization Policies: Enforcement gaps

Chapter 17: Container Escape, Kubernetes Compromise and Cluster Intrusion

1. Container Isolation: Namespaces, cgroups, capabilities and their limits
2. Container Escape Techniques: Privileged mode, mount attacks, kernel exploits
3. Kubernetes API Server Attacks: RBAC abuse, service account token theft
4. Pod Security Policies and Pod Security Standards: What they enforce and bypass
5. Egress and CNI Attacks: Network policy abuse and lateral movement
6. Defense: Hardening, runtime security, pod security, network policies

Chapter 18: Attack Chain Case Studies

1. SolarWinds SUNBURST: Supply chain, persistence and evasion (documented)
2. MOVEit Transfer: Third-party vulnerability exploitation at scale
3. 2023–2024 npm Supply Chain Campaigns: Malicious packages in action
4. Hypothetical Campaign 1: Dependency confusion to cloud lateral movement
5. Hypothetical Campaign 2: Phishing to AD compromise to cloud exfiltration
6. Common Patterns: What links these campaigns and how defenses fail

Chapter 19: Detection Engineering, Incident Response and Continuous Defense

1. Detection Architecture: Logging strategy, telemetry collection, SIEM design
2. YARA Rules and File Detection: Writing rules for supply chain indicators
3. Sigma and SIEM Rules: Query-based detection for cloud and identity attacks
4. Cloud-Native Monitoring: GuardDuty, Microsoft Defender, Chronicle
5. Incident Reconstruction: Timeline building, evidence preservation, forensics
6. Purple Team Exercises: Validating defenses with adversary emulation

Conclusion: The Engineering Mindset for Defense

Appendix A: Laboratory Setup Guide

1. Prerequisites
2. Supply Chain Security Lab
3. Active Directory Lab
4. AWS Cloud Lab
5. Kubernetes Security Lab
6. Security Notes for All Labs

Appendix B: Tool Reference

Appendix C: MITRE ATT&CK Technique Index

1. Supply Chain (Initial Access, Tactic TA0001)
2. Credential Access (Tactic TA0006)
3. Persistence (Tactic TA0003)
4. Privilege Escalation (Tactic TA0004)
5. Defense Evasion (Tactic TA0005)
6. Lateral Movement (Tactic TA0008)
7. Cloud and Containers
8. Command and Control (Tactic TA0011)
9. Exfiltration (Tactic TA0010)

Appendix D: Glossary

References