console portfolio/cloud-labs
source github/awesome-cloud-labs
ACTIVEAwesome Cloud Investigation Labs
aws · azure · gcp · curated from top cybersecurity platforms · always up to date
Cloud Provider
Platform
Difficulty
Lab Index
| Lab Name | Platform | Difficulty | Pricing | Provider | |
|---|---|---|---|---|---|
| Deep Freeze | BTLO | Easy | Subscription | AWS | Open ↗ |
| Spilled Bucket | BTLO | Easy | Subscription | AWS | Open ↗ |
| Flaws | BTLO | Easy | Subscription | AWS | Open ↗ |
| AWeSome | BTLO | Medium | Subscription | AWS | Open ↗ |
| GrumpyDev | BTLO | Medium | Subscription | AWS | Open ↗ |
| PikaBoo | BTLO | Medium | Subscription | AWS | Open ↗ |
| Nimbus - Halloween 23 | BTLO | Easy | Subscription | AWS | Open ↗ |
| S3CredentialsHunt | CyberDefenders | Medium | Subscription | AWS | Open ↗ |
| AWSRaid | CyberDefenders | Easy | Subscription | AWS | Open ↗ |
| IMDSv1 | CyberDefenders | Medium | Subscription | AWS | Open ↗ |
| AWSWatcher | CyberDefenders | Easy | Subscription | AWS | Open ↗ |
| AbuSESer - Trufflenet | CyberDefenders | Easy | Subscription | AWS | Open ↗ |
| CursorJack | CyberDefenders | Easy | Subscription | AWS | Open ↗ |
| Nubilum-1 | HTB | Medium | Subscription | AWS | Open ↗ |
| Nubilum2 | HTB | Easy | Subscription | AWS | Open ↗ |
| Heartbreaker-Denouement | HTB | Easy | Subscription | AWS | Open ↗ |
| OpTinselTrace24-3: Blizzard Breakdown | HTB | Medium | Subscription | AWS | Open ↗ |
| OpTinselTrace-2 | HTB | Easy | Subscription | AWS | Open ↗ |
| PercyPay | HTB | Easy | Free | AWS | Open ↗ |
| AWS_CloudTrail | HTB | Medium | Subscription | AWS | Open ↗ |
| AWS_PerSEStence | HTB | Medium | Subscription | AWS | Open ↗ |
| AWS_Stacked | HTB | Hard | Subscription | AWS | Open ↗ |
| AWS_Bucketware | HTB | Hard | Subscription | AWS | Open ↗ |
| User Account Creation Alchemy | CWL Infinity | Easy | Free | AWS | Open ↗ |
| User Vanishing Act | CWL Infinity | Easy | Free | AWS | Open ↗ |
| IAM Crown-Jewel Capture | CWL Infinity | Medium | Free | AWS | Open ↗ |
| Console Siege | CWL Infinity | Easy | Free | AWS | Open ↗ |
| Trust Betrayal in Relationship | CWL Infinity | Medium | Premium | AWS | Open ↗ |
| Automated Scout | CWL Infinity | Medium | Free | AWS | Open ↗ |
| User Identity Profile Makeover | CWL Infinity | Medium | Free | AWS | Open ↗ |
| Keysmith’s Gambit | CWL Infinity | Easy | Free | AWS | Open ↗ |
| Brute Bucket | CWL Infinity | Medium | Free | AWS | Open ↗ |
| Bucket policy Rebellion | CWL Infinity | Medium | Free | AWS | Open ↗ |
| EC2 Identity Modification Analysis | CWL Infinity | Medium | Free | AWS | Open ↗ |
| Leap of Lambda | CWL Infinity | Easy | Premium | AWS | Open ↗ |
| KMS Decrypt Drift | CWL Infinity | Hard | Premium | AWS | Open ↗ |
| Uncovering Queue Message Heist | CWL Infinity | Medium | Premium | AWS | Open ↗ |
| The SNS Escalation Hunt | CWL Infinity | Medium | Premium | AWS | Open ↗ |
| The Case of the Missing SSM Secrets | CWL Infinity | Hard | Premium | AWS | Open ↗ |
| RoleTrace: From Assume to Decrypt | CWL Infinity | Medium | Premium | AWS | Open ↗ |
| Vault | BTLO | Easy | Subscription | Azure | Open ↗ |
| Rotten Cloud | BTLO | Medium | Subscription | Azure | Open ↗ |
| Stormweaver's Vision | BTLO | Hard | Subscription | Azure | Open ↗ |
| AzureHunt | CyberDefenders | Easy | Subscription | Azure | Open ↗ |
| Rogue Azure | CyberDefenders | Easy | Subscription | Azure | Open ↗ |
| AzureSpray | CyberDefenders | Medium | Subscription | Azure | Open ↗ |
| DynamicEscalate | CyberDefenders | Easy | Subscription | Azure | Open ↗ |
| ConsentStorm | CyberDefenders | Medium | Subscription | Azure | Open ↗ |
| Shadow Token Symphony - APT29 | CyberDefenders | Medium | Subscription | Azure | Open ↗ |
| Code Blue - APT29 | CyberDefenders | Hard | Subscription | Azure | Open ↗ |
| Suspicious Sign-In Probe | CWL Infinity | Medium | Free | Azure | Open ↗ |
| Service Principal Credential Forging Analysis | CWL Infinity | Medium | Free | Azure | Open ↗ |
| Investigating Service Principals Permission Paradox | CWL Infinity | Medium | Free | Azure | Open ↗ |
| Storage Container Intrusion Analysis | CWL Infinity | Medium | Free | Azure | Open ↗ |
| AZ-Storage-02: Investigating AZ Container Policy Modification | CWL Infinity | Medium | Free | Azure | Open ↗ |
| AZ VM NIC Configuration Intrigue | CWL Infinity | Hard | Premium | Azure | Open ↗ |
| AZ-VM-02: Investigating suspicious Identity Role Assignment over VM instance | CWL Infinity | Easy | Free | Azure | Open ↗ |
| Key to Bucket Data Oblivion | CWL Infinity | Hard | Premium | Azure | Open ↗ |
| Detecting Rogue Invocation | CWL Infinity | Hard | Premium | Azure | Open ↗ |
| Unauthorized Logic App Flow Analysis | CWL Infinity | Hard | Premium | Azure | Open ↗ |
| Storm in the Directory | CWL Infinity | Hard | Premium | Azure | Open ↗ |
| Shadows in the Tenant | CWL Infinity | Medium | Premium | Azure | Open ↗ |
| From Failed Logins to Full Control: Hunting a User Compromise in Entra ID | CWL Infinity | Easy | Premium | Azure | Open ↗ |
| Role-Assignable Group Abuse: From Privileged Access to Stealthy Persistence | CWL Infinity | Easy | Premium | Azure | Open ↗ |
| Shadow Application Takeover | CWL Infinity | Easy | Premium | Azure | Open ↗ |
| Restricted No More - AU Bypass | CWL Infinity | Easy | Premium | Azure | Open ↗ |
| Device Manipulation After Account Compromise | CWL Infinity | Easy | Premium | Azure | Open ↗ |
| Suspicious App Consent Followed by Key Vault Secret Access | CWL Infinity | Medium | Premium | Azure | Open ↗ |
| Runbook to Root: Hunting Azure Automation Abuse | CWL Infinity | Medium | Premium | Azure | Open ↗ |
| Husky Corp | Xintra | Medium | Subscription | Azure | Open ↗ |
| Assassin Kitty | Xintra | Hard | Subscription | Azure | Open ↗ |
| GoogleCloudHunt | CyberDefenders | Medium | Subscription | GCP | Open ↗ |
| MisCloud | HTB | Easy | Subscription | GCP | Open ↗ |
| Google_Cloud_Compromise | HTB | Medium | Subscription | GCP | Open ↗ |
| Google_Cloud_Incident | HTB | Hard | Subscription | GCP | Open ↗ |
| Rogue Identity Analysis | CWL Infinity | Medium | Free | GCP | Open ↗ |
| Privileged Service Account Escalation Investigation | CWL Infinity | Easy | Free | GCP | Open ↗ |
| Service Account Key Forging Analysis | CWL Infinity | Medium | Free | GCP | Open ↗ |
| Service Account Token Theft Analysis | CWL Infinity | Medium | Free | GCP | Open ↗ |
| Tracking the Rogue Service Account | CWL Infinity | Easy | Free | GCP | Open ↗ |
| Bucket data Replication Exfil Investigation | CWL Infinity | Medium | Free | GCP | Open ↗ |
| Bucket Permission Drift Probe | CWL Infinity | Easy | Free | GCP | Open ↗ |
| Spawning Compute Activity | CWL Infinity | Medium | Free | GCP | Open ↗ |
| Analyzing Compute NIC Modifications | CWL Infinity | Medium | Free | GCP | Open ↗ |
| GCP-Function-01: Investigating CloudFunction Parody | CWL Infinity | Medium | Free | GCP | Open ↗ |
| Secret Key Extraction Investigation | CWL Infinity | Hard | Premium | GCP | Open ↗ |
| Serverless Secret Breach | CWL Infinity | Hard | Premium | GCP | Open ↗ |
Data fetched live from GitHub — always up to date
SOC · CLOUD.LABS · CHICKEN0248 · ↩ OPERATOR.PROFILE