| name | cspm-casb-attack |
| description | CSPM/CASB/CNAPP platform bypass and abuse — rule suppression exploitation, IaC state manipulation, CASB proxy evasion, SaaS shadow discovery, Wiz/Prisma/Lacework/Defender coverage gap identification, and tag-tampering attacks against cloud posture management tools. |
| origin | github-trending-2026 |
| version | 0.1.0 |
| compatibility | ["openclaw","claude-code","cursor","windsurf"] |
| allowed-tools | ["Bash","Read","Write","Edit","WebSearch","WebFetch"] |
| metadata | {"domain":"cloud","category":"cloud-posture-casb","tool_count":18,"guide_count":1,"mitre":"T1068-Exploitation for Privilege Escalation, T1565-Adversary-Inhibited-Response-System, T1611-Escape to Host","keywords":["cspm","casb","cnapp","wiz","prisma-cloud","defender-for-cloud","security-hub","lacework","orca","sysdig-secure","checkov","kics","prowler","scoutsuite","cloudfox","terrascan","snyk-iac","kubescape","netskope","zscaler-casb","skyhigh","tagsuppression","iac-drift","terraform-state","policy-as-code","opa","kyverno"]} |
Skill: CSPM / CASB / CNAPP Attack and Evasion
Supplementary Files:
payloads.md -- Per-vendor attack catalogues (Wiz, Prisma Cloud, Defender for Cloud, Security Hub, Lacework, Orca, Sysdig Secure, Checkov, KICS, Prowler, ScoutSuite, CloudFox, Terrascan, Snyk IaC, Kubescape; Netskope, Zscaler CASB, Skyhigh, Microsoft Defender for Cloud Apps, Symantec CloudSOC, Trellix MVISION). Common patterns: rule suppression abuse, IaC state file manipulation, policy-as-code bypass, CASB reverse proxy evasion, JWT/session replay through CASB, BYO-CERT pinning, multi-cloud lateral movement evading CSPM.test-cases.md -- Structured test cases (CSPM presence enumeration, rule suppression abuse, IaC state tampering, policy-as-code bypass, CASB reverse-proxy evasion, SaaS shadow discovery, tag-based suppression hunting, multi-cloud lateral movement, CNAPP graph coverage gap, Wiz query-language analysis, defender-for-cloud workbook tampering, Kubescape exception abuse) -- 12 cases across 6 categories.guides/cspm-casb-attack-playbook.md -- End-to-end playbook: enumerate CSPM/CASB presence -> identify coverage gaps -> exploit misconfig-aware attack paths -> maintain evasion via tag/policy tampering -> detection guidance. Includes a full lab setup (AWS Security Hub + Prowler + mock CASB) and four real-incident case studies (Capital One 2019, Tesla S3 2018, Microsoft SAS token leak 2020, Optus 2022, ICBC ransomware 2023).
Summary
CSPM (Cloud Security Posture Management), CASB (Cloud Access Security Broker), and CNAPP (Cloud-Native Application Protection Platform) are the defender's primary instrumentation for cloud. They watch for misconfigurations, posture drift, anomalous SaaS access, and runtime threats. This skill is the offensive counterpart: how to enumerate which posture tools are deployed, identify their coverage gaps, exploit the misconfig-aware attack paths they normalize, suppress their findings via exception and tag abuse, and evade the CASB reverse proxy on the way to SaaS targets.
Tools: pacu, scoutsuite, prowler, cloudfox, checkov, kics, terrascan, snyk-iac, kubescape,opa, kyverno, mitmproxy, burpsuite, jwt_tool, certificate-pinner, cloudlist, bucketeer, trufflehog, grpcurl
Domain: cloud
MITRE ATT&CK: T1068 (Exploitation for Privilege Escalation), T1565 (Adversary-Inhibited Response System -- finding suppression), T1611 (Escape to Host -- via IaC state poisoning that privesc to TF automation identity)
Description
CSPM, CASB, and CNAPP are the three layers defenders layer onto a cloud estate once basic IAM and config hardening are in place. CSPM tools (Wiz, Prisma Cloud, Defender for Cloud, AWS Security Hub, Lacework, Orca, Sysdig Secure) continuously scan the cloud control-plane API for misconfigurations. CASB tools (Netskope, Zscaler CASB, Skyhigh, Defender for Cloud Apps, Symantec CloudSOC, Trellix MVISION) broker and inspect SaaS traffic, enforce DLP, and detect shadow IT. CNAPP platforms (Wiz Code, Prisma CNAPP, Lacework, Orca) fuse CSPM, CWPP, and Kubernetes posture into a single graph.
These tools are not the cloud itself -- they're an API consumer layered on top of the cloud provider's API. Every CSPM has the same shape: a read-only role, a config scraper, a rules engine, a graph (often a graph DB), and a presentation layer. The offensive surface this exposes is large and underexplored:
- CSPM rule suppression is a defender-controlled primitive attackers can abuse -- every CSPM allows operators to mark findings as exceptions, suppress by tag, or define allowlists. A compromised operator identity (or a sufficient-privilege attacker in the target cloud) can create suppression rules that hide the attacker's own misconfigurations. The CSPM becomes an inhibitor of the response system (MITRE T1565.001).
- Coverage gaps are enumerable -- CSPM tools query the cloud control plane via specific APIs. The set of services they cover is documented, versioned, and discoverable. An attacker who learns the coverage matrix can choose attack paths that traverse only services the CSPM doesn't yet model. Prowler's check list, ScoutSuite's findings scope, and Wiz's supported resource inventory are all public.
- IaC state files are an out-of-band attack surface -- Terraform state files (
terraform.tfstate) frequently contain secrets and describe the desired infrastructure. Drift between state and live infrastructure is what CSPM detects; injected drift (modifying the state file to suppress a finding, or compromising the CI identity that runs terraform apply) is a platform-level bypass.
- Policy-as-code is the new gatekeeper -- OPA, Kyverno, Checkov, KICS, Terrascan, Snyk IaC, and Kubescape run as admission controllers, CI gates, and pre-merge hooks. Every one of them has bypass patterns: scope-narrow exception policies, wildcard resource matches, rego eval injection in older OPA, kyverno pattern mismatches, checkov skip comments (
# checkov:skip=CKV_AWS_18).
- CASB reverse proxies are evadable -- CASB tools intercept SaaS traffic via a forward proxy (Netskope via client / RFC 2547-style steering, Zscaler via ZTNA, Microsoft via Conditional Access app control). The interception point is a TLS terminator; evasion patterns include BYO-CERT pinning on personal devices, custom-app reverse proxy bypass, JWT replay through the proxy, API token theft from managed apps, and direct-to-origin SaaS API calls that bypass the broker entirely.
- The graph DB is the crown jewel -- Wiz's full-stack graph (and the analogous primitives in Prisma and Lacework) is the source of the kill-chain findings. Querying the Wiz graph directly (via its GraphQL API, if credentials are stolen) reveals what the defender knows about the attacker's resources. A skilled attacker uses this for self-reconnaissance -- "what does the defender see?" -- and to identify the exact tags, exceptions, or suppressed findings to abuse.
This skill covers vendor-specific enumeration (Wiz API probing, Prisma API inspection, Defender for Cloud posture enumeration, Security Hub findings filtering), common patterns (rule suppression, IaC drift injection, policy-as-code bypass, CASB proxy evasion), and the defensive counterpart (posture management methodology, real-time graph vs. point-in-time scan, policy-as-code frameworks, drift detection).
Use Cases
- CSPM presence enumeration -- Given a foothold in a cloud account, identify which CSPM/CNAPP platforms are deployed, what their coverage scope is, and where their blind spots lie. (Output: a coverage gap matrix the red team can plan attack paths around.)
- Suppression and exception abuse -- Use a compromised operator identity (or attacker-controlled cloud role with CSPM write access) to create suppression rules that hide attacker resources, then verify the suppression is effective.
- IaC state file manipulation -- Locate a Terraform state file, identify the secrets it contains, modify it to inject drift (e.g., add a public IP the CSPM will see as
managed by Terraform), or compromise the CI identity that runs terraform apply to weaponize drift at scale.
- Policy-as-code bypass -- Identify the admission/CI gate (OPA, Kyverno, Checkov, etc.), read the policy, and craft an exception or a resource specification that satisfies the policy while remaining exploitable (e.g., a checkov skip comment, an OPA rego pattern that misses a wildcard, a Kyverno pattern that fails to match a generate rule).
- CASB reverse proxy evasion -- Enumerate which SaaS apps are brokered by a CASB, identify the broker's interception method (Netskope client, Zscaler ZTNA, Conditional Access app control), and craft traffic that evades the broker (BYO-CERT pinning, custom-app bypass, direct-to-origin API calls, JWT/session replay).
- Shadow SaaS discovery (CASB scope gap) -- Enumerate unmanaged SaaS apps that users in the target org are accessing (LinkedIn, GitHub, Notion, Figma, ChatGPT) and identify the API tokens, OAuth grants, or session cookies that grant access to corporate data outside the CASB's broker scope.
- Multi-cloud lateral movement evading CSPM -- Chain credentials from one provider to another (AWS role -> Azure service principal -> GCP service account) such that each hop lands outside the per-provider CSPM's coverage scope (cross-region, cross-account, cross-provider).
- CNAPP graph coverage gap -- Identify resources that the CNAPP graph fails to model (e.g., a newly-GA service not yet supported, an alpha-region resource, a custom resource type), and choose attack paths that traverse only those resources.
- Real-incident reconstruction -- Reconstruct the CSPM/CASB bypass from Capital One 2019 (Security Hub alert ignored), Tesla S3 2018 (no CORS/MFA enforcement on console), Microsoft SAS token leak 2020 (no expiry scanning), Optus 2022 (CSPM scope gap on a public-facing API), ICBC 2023 (CSPM alerting failure) -- and distill detection patterns.
Core Tools
CSPM / CNAPP Target Enumeration
| Tool | Purpose | Command Example |
|---|
| prowler (7.4k stars) | AWS/Azure/GCP posture checker, 300+ checks mapped to CIS, MITRE, ISO, GDPR | prowler aws -c check_id / prowler aws --list-checks |
| scoutsuite (6.6k stars) | Multi-cloud posture audit, generates interactive report | scout aws -p default --report-dir /tmp/scout |
| cloudfox (Bishopfox, 2.5k stars) | "I know what permissions you have" -- enumerates the accessible surface | cloudfox aws --payload all-checks |
| checkov (Bridgecrew/Palo Alto, 6.8k stars) | IaC scanner for Terraform/CFN/K8s/ARM, 1000+ policies | checkov -d . --framework terraform |
| kics (Checkmarx, 2.2k stars) | IaC scanner -- TF/CFN/K8s/Ansible/Helm/Terraform Plan | kics scan -p ./iac --report-formats json |
| terrascan (tenable, 4.7k stars) | IaC scanner with flexible policy framework (OPA/Rego) | terrascan scan -t terraform -d . |
| snyk iac | Snyk's IaC security scanner, deep policy library | snyk iac test ./terraform/ |
| kubescape (kubescape, 15k stars) | K8s posture + NSA/CIS + policy-as-code (OPA/Rego) | kubescape scan framework nsa --verbose |
Policy-as-Code & Drift
| Tool | Purpose | Command Example |
|---|
| opa (Open Policy Agent, 9.5k stars) | Rego policy engine, used as admission controller & CI gate | opa eval -d policies/ 'data.terraform.deny' |
| kyverno (kyverno, 5.7k stars) | K8s-native policy engine, validates/mutates/generates resources | kyverno apply policies/ --resource resources/ |
| tfsec (aquasecurity, 6.6k stars) | TF static analysis, now merged into Trivy | trivy config ./terraform/ |
CASB / SaaS Evasion
| Tool | Purpose | Command Example |
|---|
| mitmproxy | TLS-intercepting proxy for studying CASB broker behavior | mitmproxy --mode reverse:https://app.example.com |
| burpsuite | Manual CASB proxy evasion, JWT/session tampering | (manual GUI workflow) |
| jwt_tool | JWT analysis, alg confusion, session replay | python3 jwt_tool.py <JWT> |
| certificate-pinner | BYO-CERT pinning for CASB bypass on personal devices | (per-app custom pinner) |
Recon & State Discovery
| Tool | Purpose | Command Example |
|---|
| cloudlist (projectdiscovery) | Multi-cloud asset enumeration from a credentials set | cloudlist -provider aws |
| trufflehog (trufflehog, 16k stars) | Secret scanner, finds tokens in state files & git history | trufflehog filesystem ./terraform.tfstate |
| grpcurl | Used to query Wiz's GraphQL API directly after credential theft | grpcurl -d @ ... (actually curl + JSON; see payloads.md §3) |
Methodology
Attack Chain: CSPM/CASB Platform Bypass
1. Enumerate 2. Coverage-Gap 3. Choose Attack Path 4. Suppress / Evade 5. Maintain
───────────────── ─────────────── ────────────────── ────────────────── ─────────────
CSPM presence ──> identify blind spots ──> pick path outside ──> tag-tamper finding, ──> cross-cloud lateral
(prowler, scoutsuite, (unsupported services, CSPM coverage inject IaC drift, movement, period
cloudfox,Security Hub) regions, resource types) policy-as-code bypass, re-suppression
CASB proxy evasion
│
▼
Compromised operator
identity creates a
suppression rule (T1565)
Phase Details
- CSPM Presence Enumeration -- Probe the target cloud account for evidence of a deployed CSPM/CNAPP. AWS: look for
Security Hub enabled, AWS Config recorders, Audit Manager, IAM roles matching Wiz*, Prisma*, Lacework*, Sysdig*, Orca*, Prowler*. Azure: Microsoft Defender for Cloud provisioning, Azure Policy assignments, Security Center workspace. GCP: Security Command Center (SCC) enabled, Org Policy service assignments. Use cloudfox and iam enumeration to map what the CSPM service-linked roles can read.
- Coverage Gap Identification -- Build a matrix of what the CSPM covers vs. what the cloud offers. Wiz publishes its supported resource list per cloud; Prisma publishes its policies RQL library; Prowler ships its check list. Compare against the cloud provider's full service catalog (e.g., AWS has 200+ services; Wiz may cover 80). Services not covered are blind spots. Newly-GA services, alpha regions, and custom (non-cloud-native) resources are classic blind spots.
- Attack Path Selection -- Choose an attack path that maximizes time in the blind spot. Examples: a service the CSPM doesn't yet model, a region the CSPM isn't scanning, a resource type that requires an exception in the CSPM's rules. Combine with conventional cloud-security attack paths (cross-account role assumption, IMDS-leaked credentials) to make the path viable.
- Suppression / Evasion -- Once the attacker has a foothold, evade the CSPM in one of three ways: (a) tag-tampering -- add a tag the CSPM treats as
exception/allowlist; (b) IaC drift injection -- modify the Terraform state so the CSPM sees the resource as managed (some CSPMs treat managed resources differently); (c) policy-as-code bypass -- if Checkov/KICS/OPA run as CI gates, add skip comments or scope exceptions.
- CASB Proxy Evasion (when SaaS targets are in play) -- Enumerate which SaaS apps are brokered, identify the broker's interception method, and craft traffic that bypasses it (direct-to-origin API calls, BYO-CERT pinning, custom-app reverse proxy evasion, JWT/session replay).
- Multi-Cloud Lateral Movement -- Use the foothold to chain credentials across providers (AWS -> Azure -> GCP) such that each hop lands outside the per-provider CSPM's scope. The cross-provider hop is the most common gap because most CSPM deployments are per-provider.
- Detection Evasion Maintenance -- Continuously re-enumerate the CSPM's coverage, re-suppress any findings that surface (using a compromised operator identity), and avoid any resource type the CSPM models well.
Defense Perspective
| Defense Measure | Description |
|---|
| Real-time graph over point-in-time scan | Wiz and Prisma's real-time graph (driven by CloudTrail + config snapshots) closes the gap between config change and detection. Point-in-time scanners (Prowler scheduled runs) have hours-to-days of exposure window. |
| Immutable suppression audit trail | Every CSPM rule exception, suppressed finding, and allowlist must be logged with operator identity, reason, and expiry. Quarterly review of all suppressions. |
| Tag-based suppression lockdown | Don't allow arbitrary tags to suppress findings; only allow approved tag keys (e.g., approved-exception, breakglass) with a change-managed value. |
| Policy-as-code in CI + admission | Checkov/KICS/Snyk IaC in CI gates failures on PR; Kyverno/OPA at admission prevents in-cluster bypass. Both must agree -- a CI-only gate is bypassable by a direct apply. |
| IaC state file encryption + access logging | Terraform state files contain secrets; store in encrypted backends (S3 SSE-KMS, Azure Storage TDE), grant least-privilege read, and alert on out-of-band modifications. |
| CASB direct-to-origin detection | SaaS providers (Microsoft 365, Google Workspace) log the source IP of API calls; configure alerts for direct API access that bypasses the CASB broker IP range. |
| Shadow SaaS discovery + managed-app onboarding | Use CASB discovery mode (read-only SaaS log ingestion) to find unmanaged apps; actively onboard those with corporate data; revoke OAuth grants to unmanaged apps. |
| Cross-cloud graph (CNAPP) | A CNAPP that correlates AWS+Azure+GCP resources in a single graph closes the cross-provider lateral movement gap; per-provider CSPMs miss the cross-provider hop. |
Practical Steps
For detailed payloads see payloads.md, and for the complete test checklist see test-cases.md.
Exercise 1: CSPM Presence Enumeration (AWS)
Identify which posture tools are deployed in a target AWS account.
aws iam list-roles --query 'Roles[?RoleName.contains(@, `Wiz`) || contains(@, `Prisma`) || contains(@, `Lacework`) || contains(@, `Sysdig`) || contains(@, `Orca`) || contains(@, `Prowler`)].RoleName'
aws securityhub describe-hub --region us-east-1
aws configservice describe-configuration-recorders
aws guardduty list-detectors --region us-east-1
aws securityhub get-enabled-standards
aws cloudtrail describe-trails
Exercise 2: Coverage Gap Matrix Construction
Use Prowler and ScoutSuite's check lists to identify what's covered, then diff against the cloud provider's full service catalog.
prowler aws --list-checks | sort -u > prowler-checks.txt
wc -l prowler-checks.txt
aws service-allocator list-services 2>/dev/null || aws --region us-east-1 ecs list-services
awk -F_ '{print $2}' prowler-checks.txt | sort -u > prowler-services.txt
Exercise 3: Wiz GraphQL API Self-Reconnaissance
After stealing a Wiz service account token, query the graph directly to see what the defender knows about your resources.
echo "$WIZ_JWT" | cut -d. -f2 | base64 -d 2>/dev/null | jq '.'
curl -s "$WIZ_ENDPOINT/graphql" \
-H "Authorization: Bearer $WIZ_JWT" \
-H 'Content-Type: application/json' \
--data '{"query":"query { assets(first: 100) { nodes { id name type findings { severity } } } }"}' \
| jq '.data.assets.nodes[] | {name, type, sev: [.findings[].severity]}'
Exercise 4: Rule Suppression Abuse (AWS Security Hub)
Create a suppression rule that hides a specific finding.
aws securityhub get-findings --filters 'SeverityLabel=[{Value="HIGH",Comparison="EQUALS"}]' \
--query 'Findings[0].Id'
aws securityhub create-insight \
--name "suppressed-non-issue" \
--filters 'ResourceAwsEc2InstanceId=[{Value="REPLACE_WITH_YOUR_INSTANCE_ID",Comparison="EQUALS"}]' \
--group-by-attribute 'RuleId'
aws securityhub get-findings --filters 'ResourceAwsEc2InstanceId=[{Value="REPLACE_WITH_YOUR_INSTANCE_ID",Comparison="EQUALS"}]' \
--query 'Findings'
Exercise 5: Terraform State File Drift Injection
Locate a state file, identify the secrets it contains, and craft a drift injection.
find / -name 'terraform.tfstate*' 2>/dev/null
find / -name '*.tfstate' 2>/dev/null
trufflehog filesystem ./terraform.tfstate
jq '.resources[] | {type, name, instances: .instances[0].attributes | keys}' terraform.tfstate | head -40
Exercise 6: CASB Reverse Proxy Evasion
Identify a CASB-brokered SaaS app and craft direct-to-origin traffic.
mitmproxy --mode regular -p 8080
dig app.example.com
curl -H "Authorization: Bearer $SAAS_JWT" https://app.example.com/api/v1/files
Exercise 7: Checkov Skip-Comment Bypass
Identify a Checkov gate in CI and add a skip comment to bypass a single check.
cat >> main.tf <<'EOF'
resource "aws_s3_bucket" "exfil" {
bucket = "REPLACE_WITH_YOUR_BUCKET_NAME"
}
EOF
checkov -d . --framework terraform --quiet
Hacker Laws
| Law | Manifestation in CSPM/CASB Attack |
|---|
| Defense in Depth | CSPM+CASB+CNAPP is itself a defense-in-depth stack; this skill teaches how to identify which layer is missing and exploit the gap. A single bypassed layer shouldn't mean total compromise. |
| Trust but Verify | Don't trust the CSPM's default coverage. Wiz covers 80 services; AWS offers 200+. The gap is the trust deficit. Verify coverage via matrix construction (Exercise 2). |
| Least Privilege | A CSPM's read-only role is the ideal target -- it sees everything but writes nothing. A compromised operator identity (with write) is the highest-value primitive for suppression. Enforce least-privilege on operator identities to limit suppression scope. |
| Assume Breach | Assume the attacker has a foothold. The CSPM is the alarm; this skill teaches how the attacker silences the alarm (T1565). Run quarterly "suppression hunting" exercises. |
| Minimize Attack Surface | Every IaC template, every tag key, every exception policy is attack surface. Reduce by (a) limiting tag keys, (b) scoping exception policies tightly, (c) restricting who can run terraform apply. |
| First Principles | Understand that the CSPM is just an API consumer layered on top of the cloud's own API. It cannot detect what it cannot query. The coverage matrix is the truth, not the marketing slick. |
| Compromise = Adversary + Time | The longer the attacker's dwell time, the higher the chance they enumerate the CSPM, identify the gap, and suppress findings. Real-time graph CSPMs (Wiz, Prisma) shrink the time window; point-in-time scanners (Prowler scheduled runs) widen it. |
Differentiation
| Skill | Focus | Overlap with cspm-casb-attack |
|---|
cspm-casb-attack (this) | CSPM/CASB/CNAPP platform bypass -- rule suppression, IaC drift injection, policy-as-code bypass, CASB proxy evasion, coverage gap identification -- platform-evasion-centric | -- |
cloud-security | General cloud infra assessment (AWS/Azure/GCP IAM, S3, IMDS, storage, networking) | Shares cloud-provider surface; cloud-security assesses the infra, this skill evades the defender's platform layered on top. |
kubernetes-attack | Offensive operations against a live K8s cluster -- RBAC, pod escape, SA token theft, etcd exploitation | Shares K8s admission-policy surface (Kyverno, OPA Gatekeeper); this skill targets policy-as-code at the IaC + admission + CI layers, not cluster-internal attack paths. |
container-security | Container defense and best practices | Shares runtime detection surface; container-security defends, this skill evades the defender's instrumentation. |
cloud-identity-attack | Identity-based attacks (AWS STS, Azure service principals, OAuth grants) | Shares identity primitives; cloud-identity-attack is about abusing identity, this skill is about abusing the platform that watches identity-driven misconfigs. |
cloud-native-vuln-research | CVE research, PoC reproduction, nuclei templates, exploit chain composition | CVE-driven; this skill is platform-evasion-driven (suppressing a Wiz finding is not a CVE). |
api-security | API attack surface, authn bypass, rate-limit bypass, schema fuzzing | Shares JWT/session replay primitives; this skill applies them specifically to CASB-brokered SaaS apps. |
ad-ldap-attack | AD/LDAP on-prem identity attack | Shares conditional-access surface; Defender for Cloud Apps bridges Azure AD into CASB -- overlap is at the broker layer. |
This skill is platform-evasion, not cloud-config assessment (use cloud-security), not cluster-internal attack (use kubernetes-attack), not CVE research (use cloud-native-vuln-research). It produces attack paths that evade the defender's cloud instrumentation.
Orchestration
ECC Loop Pattern
- Pattern: Iterative Refinement
- Rationale: CSPM/CASB evasion is iterative -- enumerate, identify gap, exploit, suppress, re-enumerate to verify suppression. The ECC loop drives each phase with explicit feedback.
- Integration:
cloud-security (base cloud recon), codebase-onboarding (IaC template analysis), verification-loop (suppression-effectiveness verification)
Cross-Skill Pipeline
cloud-security -> cloud-identity-attack -> cspm-casb-attack -> verification-loop -> pentest-reporting
Quality Gate
- Pre-condition: A cloud foothold exists (an instance, a role, a credential) -- or the engagement scope is to assess a defender's CSPM/CASB deployment from outside.
- Post-condition: A documented coverage gap matrix, at least one demonstrated suppression/evasion, and a verification artifact showing the suppression was effective.
- Verification: Use
verification-loop Phase 4 (cross-tool confirmation -- e.g., Prowler + ScoutSuite cross-check that a finding is actually suppressed in Security Hub).
Learning Resources
Supplementary files for this skill: payloads.md, test-cases.md, guides/cspm-casb-attack-playbook.md
Related skills: skills/cloud-security/SKILL.md, skills/kubernetes-attack/SKILL.md, skills/cloud-identity-attack/SKILL.md, skills/cloud-native-vuln-research/SKILL.md
External resources:
