AWS-Threat-Simulation-and-Detection – Playing Around With Stratus Red Team (Cloud Attack Simulation Tool) And SumoLogic
This repository is a documentation of my adventures with
| Attack | Description | Link |
|---|---|---|
| aws.credential-access.ec2-get-password-data | Retrieve EC2 Password Data | Link |
| aws.credential-access.ec2-steal-instance-credentials | Steal EC2 Instance Credentials | Link |
| aws.credential-access.secretsmanager-retrieve-secrets | Retrieve a High Number of Secrets Manager secrets | Link |
| aws.credential-access.ssm-retrieve-securestring-parameters | Retrieve And Decrypt SSM Parameters | Link |
| aws.defense-evasion.cloudtrail-delete | Delete CloudTrail Trail | Link |
| aws.defense-evasion.cloudtrail-event-selectors | Disable CloudTrail Logging Through Event Selectors | Link |
| aws.defense-evasion.cloudtrail-lifecycle-rule | CloudTrail Logs Impairment Through S3 Lifecycle Rule | Link |
| aws.defense-evasion.cloudtrail-stop | Stop CloudTrail Trail | Link |
| aws.defense-evasion.organizations-leave | Attempt to Leave the AWS Organization | Link |
| aws.defense-evasion.vpc-remove-flow-logs | Remove VPC Flow Logs | Link |
| aws.discovery.ec2-enumerate-from-instance | Execute Discovery Commands on an EC2 Instance | Link |
| aws.discovery.ec2-download-user-data | Download EC2 Instance User Data | TBD |
| aws.exfiltration.ec2-security-group-open-port-22-ingress | Open Ingress Port 22 on a Security Group | Link |
| aws.exfiltration.ec2-share-ami | Exfiltrate an AMI by Sharing It | Link |
| aws.exfiltration.ec2-share-ebs-snapshot | Exfiltrate EBS Snapshot by Sharing It | Link |
| aws.exfiltration.rds-share-snapshot | Exfiltrate RDS Snapshot by Sharing | Link |
| aws.exfiltration.s3-backdoor-bucket-policy | Backdoor an S3 Bucket via its Bucket Policy | Link |
| aws.persistence.iam-backdoor-role | Backdoor an IAM Role | Link |
| aws.persistence.iam-backdoor-user | Create an Access Key on an IAM User | TBD |
| aws.persistence.iam-create-admin-user | Create an administrative IAM User | TBD |
| aws.persistence.iam-create-user-login-profile | Create a Login Profile on an IAM User | TBD |
| aws.persistence.lambda-backdoor-function | Backdoor Lambda Function Through Resource-Based Policy | TBD |
Credits
- Awesome team at Datadog, Inc. for Stratus Red Team here
- Hacking the Cloud AWS
- Falcon Force team blog
Download AWS-Threat-Simulation-and-Detection
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.
