update TTPs for AWS Services #11

SaschaDietsch · 2024-06-15T15:32:28Z

The purpose of this PR is to add possible MITRE ATT&CK TTPs, which are reasonably possible, but have not been verified by external sources, such as research or in the wild observations

starting wth A

SaschaDietsch · 2024-06-15T15:34:54Z

I'm open for suggestions. :)

Next is refactoring services from A-C

…nto improve-ATT&CK-mapping

to add skeleton

Next are services starting with E

All other services starting with E should not be that long.

Moving to AWS Services starting with G. Those should be Glue and GuardDuty.

Next is IAM

next is KMS

Next is Lambda

Next is the organizations service.

next is RDS and ResourceExplorer

Next is S3

Just a few more entries :)

…nto improve-ATT&CK-mapping

adanalvarez

I’m reviewing here approximately 70 files (I'll add more reviews in the next few days). The amount of work done here is incredible, THANKS a lot! This adds significant value, as the unverified sub-techniques provide a broader perspective on potential attacks involving specific API calls.

I’ve included some comments on certain techniques that, although they might match attack patterns, I believe could cause confusion due to the nature of the technique and how MITRE describes them. In some cases, I think it may be better to limit the number of techniques to avoid confusion, but that’s just my opinion.

adanalvarez · 2024-09-03T20:28:01Z

events/AppSync/CreateApiKey.json

+            "technique": "T1056.004 - Credential API Hooking",
+            "reason": "Attackers may hook into the API key creation process to intercept and use these credentials for unauthorized access."


I belive this sub-technique is only windows focused and might cause confusion adding it here. Even if an attacker can intercept traffic to this API I wouldn't consider it hooking.

Sure, will remove it. I had it included because "Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials."

events/AppSync/CreateApiKey.json

adanalvarez · 2024-09-03T21:23:58Z

events/AppSync/UpdateGraphqlApi.json

+            "technique": "T1027 - Obfuscated Files or Information",
+            "reason": "The API call might be used to modify or obfuscate logs and configurations to avoid detection."


This technique is about making "an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit"

As this are not files from an operative system, I'm not sure if this applies.

I am unsure why MITRE named it "Obfuscated Files or Information" and then did not have a reference on obfuscated information. The best I could find is

Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. [2] Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. [3]

I admit it may not be the best match, but I thought to give it a try.

In some way, I can see adding obfuscated code in the configuration or creating an endpoint for doing this. I see it too complex for an attack but is true that can happen.

adanalvarez · 2024-09-03T21:30:26Z

events/Bedrock/GetModelInvocationLoggingConfiguration.json

+            "technique": "T1027 - Obfuscated Files or Information",
+            "reason": "Attackers may use knowledge of logging configurations to craft their actions in ways that avoid triggering specific logging mechanisms."


As in the previous comment about this technique, I think it is focused on files on a files system. I think even knowing the configuration, this technique won't happen as the files won't be in a filesystem.

See my previous comment. If you think it should be removed I'll do it.

I think I see your point, maybe knowing the configuration, you'll act in a way that logs won't contain enough information to be useful and this might be considered obfuscation. I have no strong opinion on removing or not, my comments in general are to raise questions on techniques that I have more problems seeing the relationship and because of this, I wonder if this is going to help or might generate confusion.

I do appreciate your insights & comments. I do not have a strong opinion on it either.

adanalvarez · 2024-09-03T21:41:37Z

events/CloudFront/CreateFunction2020_05_31.json

+        {
+            "technique": "T1106 - Native API",
+            "reason": "The creation of a CloudFront function involves direct interaction with AWS APIs, potentially leveraging native functionalities."


I think the native API technique focueses only on native OS application programming interface.

You are right on that. My thought process was that inside AWS this is the native API. Maybe the framework needs to have something similar for cloud and container environments.

I agree, I think there might be a lack of cloud-related techniques in MITRE framework but I think it is also because MITRE only has techniques that come from real-word observations, and cloud attacks are still "basic". So as with most of my other comments, I'm not saying is bad but it might generate confusion based on MITRE techniques description and scope.

I will remove it for now. If it is still needed we can bring it back.

adanalvarez · 2024-09-04T15:19:49Z

events/EC2/DescribeFlowLogs.json

+            "technique": "T1040 - Network Sniffing",
+            "reason": "By analyzing flow logs, attackers can infer traffic patterns and potentially sensitive information about network communications"


Not sure if this can be classified as network sniffing. But maybe in some scenarios by looking at the traffic and its IPs an attacker can know the webs/services being used.

Not only that. One could also see what kind of activity is being done with the service. If you type in a command via hand over SSH it is transmitted not that fast compared to when a script is doing it. Such things are possible with a bit of traditional machine learning.

adanalvarez · 2024-09-04T19:37:51Z

events/EC2/DescribeImages.json

+        {
+            "technique": "T1496 - Resource Hijacking",
+            "reason": "By understanding the available images, an attacker could hijack resources by creating instances using these images for malicious activities such as cryptocurrency mining."
+        },
+        {
+            "technique": "T1027 - Obfuscated Files or Information",
+            "reason": "Attackers can use knowledge about available images to obfuscate their activities by using less monitored or unusual images"
+        },
+        {
+            "technique": "T1562 - Impair Defenses",
+            "reason": "By identifying specific images that might have security tools, attackers can choose to avoid those images or disable the security tools present in them"
+        },


I think even if the describeImages can provide some information for attackers to do any of these techniques, I don't see them as strictly related.

Point taken. I will remove those.

adanalvarez · 2024-09-04T19:39:58Z

events/EC2/DescribeImages.json

+            "technique": "T1202 - Indirect Command Execution",
+            "reason": "By using DescribeImages, attackers can identify images that may allow them to indirectly execute commands through specific software or configurations present in the images"


I don't see how the information provided by DescribeImages can allow for indirect command execution. At least, I see it as very difficult as the information provided by the API is limited.

I will remove it. My thoughts were that one could select an AMI image where you have something like a command interpreter already exposed which one could use for command execution.

adanalvarez · 2024-09-04T19:42:09Z

events/EC2/DescribeImages.json

+            "technique": "Using DescribeImages helps attackers discover available cloud services, their configurations, and associated resources.",
+            "reason": "Attackers can use DescribeImages to identify and exploit vulnerabilities in the software dependencies and development tools used within specific images, leading to a supply chain compromise"


The technique here is the reason from the previous tehcnique

That was a copy/Paste error. Next push will fix this. It should have been T1195 - Supply Chain Compromise.

adanalvarez · 2024-09-04T20:05:37Z

events/EC2/DescribeInstances.json

+            "technique": "T1078 - Valid Accounts",
+            "reason": "Information obtained from DescribeInstances can help an adversary identify valid user accounts and their associated permissions, especially if they are looking for accounts with elevated privileges."


I think the Valid Accounts technique focuses on the use of valid accounts. In this case, DescribeInstances does not help to get or use Valid accounts.

Point taken. Removed.

and remove other erros - Part 1

SaschaDietsch · 2024-09-06T22:14:15Z

I do think that is most cases you are right and i will delete the offending techniques. For me this is all a learning experience. Therefore I am glad about the feedback.

…nto improve-ATT&CK-mapping

adanalvarez · 2024-09-07T20:16:58Z

events/EC2/DescribeKeyPairs.json

+            "technique": "T1078 - Valid Accounts",
+            "reason": "Accessing key pairs allows attackers to use valid credentials to authenticate and access systems, leading to potential unauthorized use of valid accounts."


DescribeKeyPairs only gives you the fingerprint but nothing valuable that can be used for accessing the ec2.

Good point. I will remove that.

adanalvarez · 2024-09-07T20:18:25Z

events/EC2/DescribeKeyPairs.json

+            "technique": "T1530 - Data from Cloud Storage Object",
+            "reason": "If key pairs are stored in cloud storage, an attacker could retrieve these key pairs, potentially leading to unauthorized access."


DescribeKeyPairs only gives information that can't be used for authentication https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_KeyPairInfo.html

Good point. Removed.

adanalvarez · 2024-09-07T20:21:24Z

events/EC2/DescribeRegions.json

+            "technique": "T1213 - Data from Information Repositories",
+            "reason": "DescribeRegions provides metadata about regions, which can be seen as a form of information repository. Attackers may gather this data to understand the environment better."


I0m not sure I can see a region as a repository. I think a region is much more than a repository of information.

It seems that I have written it in a poor way. My thought was that the regional metadata which is returned is an information repository.

adanalvarez · 2024-09-07T20:24:07Z

events/EC2/DescribeReplaceRootVolumeTasks.json

+            "technique": "T1106 - Native API",
+            "reason": "Utilizing native AWS APIs to gather configuration data is a method for defense evasion, blending in with regular activity."


T1106 refers to native IOS API so I believe this might cause confusion.

Yeah I can see your point. My thought process that the API that AWS exposes is the native OS API for the cloud environment one is in.

adanalvarez · 2024-09-07T20:26:49Z

events/EC2/DescribeSecurityGroups.json

+            "technique": "T1190 - Exploit Public-Facing Application",
+            "reason": ""


I think you can gather information for later exploiting but with the describe you won't be able to exploit any app.

Also I forgot to put in an explanation. My explanation I forgot to put in was

If security group rules expose public-facing applications or resources, adversaries may identify these applications as targets for exploitation. The DescribeSecurityGroups API call helps identify such applications by revealing permissive rules.

I will remove it.

adanalvarez · 2024-09-11T19:27:31Z

events/EC2/ModifySnapshotAttribute.json

+            "technique": "T1531 - Account Access Removal",
+            "reason": "Modifying snapshot permissions could be used to remove legitimate access, disrupting recovery efforts, and aiding in defense evasion."


I don't see a way to prevent access to accounts to AWS. Even to this snapshot.

I'll remove it for now.

adanalvarez · 2024-09-11T19:30:03Z

events/EC2/RunInstances.json

+            "technique": "T1133 - External Remote Services",
+            "reason": "Instances can be accessed and controlled remotely, facilitating initial access and persistent control over the cloud environment through remote services."


Do you mean like, creating an EC2 that is a VPN and because of this getting persistence?

Yeah. an EC2 that is acting as a kind of VPN.

adanalvarez · 2024-09-11T19:32:12Z

events/EC2/SendSerialConsoleSSHPublicKey.json

+            "technique": "T1053 - Scheduled Task/Job",
+            "reason": "Attackers could set up scheduled tasks or jobs on the EC2 instance to maintain persistence after gaining access."


I see this as something that will happen once an attacker has access to the EC2 and in this case all techniques related to the OS of the EC2 will be valid. So I don't see this one related to this API call.

Point taken. I will remove it.

adanalvarez · 2024-09-11T19:33:52Z

events/EC2/SendSerialConsoleSSHPublicKey.json

+            "technique": "T1105 - Ingress Tool Transfer",
+            "reason": "Attackers may transfer additional tools to the EC2 instance to facilitate further actions."


Similar to T1053, I see this as something that happens after but not related to this API call.

Point taken. I will remove it.

adanalvarez · 2024-09-11T19:44:34Z

events/EC2/SharedSnapshotVolumeCreated.json

+        },
+        {
+            "technique": "T1027 - Obfuscated Files or Information",
+            "reason": "Adversaries might obfuscate the data within snapshots to avoid detection during transfer. This can involve encrypting the contents of a snapshot or otherwise making the data less recognizable to automated defense mechanisms"


The way you see this is all information is stored in an e2 and then exfiltrated via a snapshot?

Yes. That is the way I thought.

adanalvarez · 2024-09-24T14:50:37Z

events/ECS/CreateService.json

+        },
+        {
+            "technique": "T1556 - Modify Authentication Process",
+            "reason": "The AWS CreateService API call can be used to create tasks that modify authentication processes within a cloud environment."


I'm not sure how the CreateService can help with this. If it is because the ECS has more privileges than the current user then I would go for a privilege scalation technique. If it is doing the change via the ECS just because of its IP, then probably the proxy that is already added here is enough.

What do you think about creating a task that proxies or monitors user uthentication requests?

adanalvarez · 2024-09-24T14:52:02Z

events/ECS/RegisterTaskDefinition.json

+            "technique": "T1203 - Exploitation for Client Execution",
+            "reason": "Task definitions might be crafted to exploit vulnerabilities within the container runtime or application, leading to execution"


I think this technique is only aboud exploiting code for RCE

Point taken. I will remove it.

adanalvarez · 2024-09-24T14:54:13Z

events/EFS/DeleteFileSystem.json

+            "technique": "T1531 - Account Access Removal",
+            "reason": "Deleting an EFS file system cuts off access to the data for all users and systems that rely on it. This action effectively removes the ability to access critical resources, potentially disrupting operations."


I think the other mentioned techniques cover the deletion of data. In this case, I think AWS accounts will still be able to access just that the EFS won't be there

Good point. I will remove that.

adanalvarez · 2024-09-24T14:57:17Z

events/EFS/DeleteMountTarget.json

+            "technique": "T1496 - Resource Hijacking",
+            "reason": "Deleting mount targets can free up resources, potentially redirecting them to other malicious activities or hindering legitimate use, indirectly impacting operations."


Not sure about this one. I don't see how DeleteMountTarget can be abused for resource hijacking.

It had something to do with quotas. After some thought I am going to remove that.

adanalvarez · 2024-09-24T15:08:43Z

events/EKS/AssociateAccessPolicy.json

+            "technique": "T1003 - OS Credential Dumping",
+            "reason": "Modifying access policies might allow attackers to gain access to sensitive areas of the system where they can extract credentials."


Not sure how the AssociateAccessPolicy can help attackers with OS credential dumping.

Add a access policy that allows executing into pods and then grabbing their OS credentials would be one way to do it.

adanalvarez · 2024-09-24T15:49:33Z

events/EventBridge/RemoveTargets.json

+            "technique": "T1531 - Account Access Removal",
+            "reason": "Removing targets from EventBridge rules can prevent specific users or roles from being notified or triggered, effectively removing their access to critical information or actions."


Agree with the reason but this matches the impaired defenses. The accounts are still able to log in, the problem is that they won't receive a notification.

I will remove it.

adanalvarez · 2024-09-24T15:50:47Z

events/Glue/CreateDevEndpoint.json

+            "technique": "T1106 - Native API",
+            "reason": "Using the AWS Glue API to create development endpoints can facilitate malicious actions within the AWS environment by leveraging legitimate service functionalities."


This technique only applies to OS API not to API in general.

adanalvarez · 2024-09-24T15:52:43Z

events/Glue/CreateDevEndpoint.json

+            "technique": "T1136 - Create Account",
+            "reason": "Attackers can create new accounts with permissions to create and use development endpoints, facilitating unauthorized access and persistence in the environment."
+        },
+        {
+            "technique": "T1053 - Scheduled Task/Job",
+            "reason": "cheduling jobs on the development endpoint ensures that malicious payloads or scripts are executed at specific times, aiding in persistence and automated execution."


Not sure about these 2, CreateDevEndpoint does not help in the creation of new accounts and neither it can help to schedule tasks or jobs.

Agreed. I will remove those two.

adanalvarez · 2024-09-24T16:30:22Z

events/Glue/UpdateDevEndpoint.json

+            "technique": "T1106 - Native API",
+            "reason": "The development endpoint update might utilize native APIs for malicious purposes, including privilege escalation or evasion."
+        },
+        {
+            "technique": "T1053 - Scheduled Task/Job",
+            "reason": "UpdateDevEndpoint could be used to create or modify scheduled tasks that ensure malicious scripts are run periodically."
+        },


Native API it is only for OS API. The scheduled Tasks job technique . I'm not sure I understand how this endpoint might help with this.

I'll remove those two for now.

adanalvarez · 2024-09-24T18:40:40Z

events/Glue/UpdateJob.json

+            "technique": "T1484 - Domain or Tenant Policy Modification",
+            "reason": "Adversaries can change job definitions to alter the behavior of the Glue job, affecting the overall data processing policies and workflows within the AWS environment."


This technique seems to much related with AD or Trust policies between domain, for this reason I'm not sure this one matches here.

I am also a byte unsure. I will remove it for now.

adanalvarez · 2024-09-28T14:24:03Z

events/GuardDuty/CreateFilter.json

+            "technique": "T1070 - Indicator Removal",
+            "reason": "Adversaries can create filters that suppress alerts for file deletion activities, allowing them to remove indicators of their presence without triggering alarms."


I think this is Impair Defenses. As the action does not allow removing anything but impacts the defenses ( triggering alerts)

Ok, will remove that. I will add T1562.001 - Impair Defenses: Disable or Modify Tools as a subtechnique instead.

adanalvarez · 2024-09-28T14:28:02Z

events/GuardDuty/DeleteMembers.json

+    "unverifiedMitreAttackTechniques": [
+        {
+            "technique": "T1531 - Account Access Removal",
+            "reason": "Deleting GuardDuty member accounts can prevent legitimate users from accessing the service, thus disrupting monitoring and security alerts."


Suggested change

"reason": "Deleting GuardDuty member accounts can prevent legitimate users from accessing the service, thus disrupting monitoring and security alerts."

"reason": "Deleting GuardDuty member accounts can prevent legitimate accounts from getting data from member accounts, thus disrupting monitoring and security alerts."

Suggestion is applied in next commit.

adanalvarez · 2024-09-28T14:29:14Z

events/GuardDuty/DeletePublishingDestination.json

+    "unverifiedMitreAttackTechniques": [
+        {
+            "technique": "T1485 - Data Destruction",
+            "reason": "Although not directly data destruction, it disrupts the availability of security logs which could be considered an impact on the integrity and availability of logging data."


I think this is what Impair defense covers.

Yeah. I will remove that.

adanalvarez · 2024-09-28T14:30:28Z

events/GuardDuty/DeletePublishingDestination.json

+        },
+        {
+            "technique": "T1531 - Account Access Removal",
+            "reason": "Deleting the publishing destination can prevent security personnel from receiving critical alerts, effectively limiting their ability to respond to threats. This action reduces the ability to monitor and manage GuardDuty findings, thereby diminishing the security team's control over the environment."


I think this is also part of Impair defenses, because users can still access the AWS account

I will remove that too.

adanalvarez · 2024-09-28T14:32:29Z

events/GuardDuty/DisassociateFromMasterAccount.json

+        },
+        {
+            "technique": "T1485 - Data Destruction",
+            "reason": "By disassociating the account, attackers may intend to evade detection and subsequently destroy data within the compromised account without triggering alerts in the central monitoring account."


I think this and Data Manipulation is just part of what can happen after, but the event itself help as mentioned in the reason to evade detection so it Impair defenses.

adanalvarez · 2024-09-28T19:41:27Z

events/IAM/PutUserPolicy.json

+    "unverifiedMitreAttackTechniques": [
+        {
+            "technique": "T1070 - Indicator Removal",
+            "reason": "Updating inline policies can help adversaries evade detection by altering the permissions without creating new, noticeable accounts."


Also, it is not clear to me how adding a policy you might be removing evidence of their presence. I can see Impair defenses by maybe adding a policy that denies access.

adanalvarez · 2024-09-28T19:42:10Z

events/IAM/PutUserPolicy.json

+            "technique": "Adversaries may use PutUserPolicy to remove access rights for legitimate users, causing disruption.",
+            "reason": "If an adversary can modify policies to grant administrative privileges, they effectively escalate their privileges."


This seems like privilege escalation

It was T1068 - Exploitation for Privilege Escalation. Fixed in next commit.

adanalvarez · 2024-09-28T19:44:08Z

events/IAM/SetDefaultPolicyVersion.json

+    "unverifiedMitreAttackTechniques": [
+        {
+            "technique": "T1070 - Indicator Removal",
+            "reason": "Modifying the policy's default version can be used to evade detection by altering the policies that would trigger alarms or logs."


Suggested change

"reason": "Modifying the policy's default version can be used to evade detection by altering the policies that would trigger alarms or logs."

"reason": "Modifying the policy's default version can be used to evade detection by setting the policy version that was in place before the attack."

Suggestion added in next commit.

adanalvarez · 2024-09-28T19:46:07Z

events/IAM/UpdateAccessKey.json

+    "unverifiedMitreAttackTechniques": [
+        {
+            "technique": "T1070. - Indicator Removal",
+            "reason": "Disabling keys can be a tactic to remove indicators of compromise, preventing detection and forensic analysis."


Suggested change

"reason": "Disabling keys can be a tactic to remove indicators of compromise, preventing detection and forensic analysis."

"reason": "Disabling keys can be a tactic to remove indicators of compromise, because keys need to be disabled before deletion, preventing detection and forensic analysis."

Added suggestion to next commit.

adanalvarez · 2024-09-28T19:50:01Z

events/IAM/UpdateAssumeRolePolicy.json

+        },
+        {
+            "technique": "T1036 - Masquerading",
+            "reason": "T1036.005] - Masquerading"


Suggested change

"reason": "T1036.005] - Masquerading"

"reason": "Attackers can allow access from an account they control to assume a valid role that is used in the organization making the access appear legitimate"

Whoops that was a copy/Paste error. Thank you for the suggestion!

adanalvarez · 2024-09-29T11:16:38Z

events/KMS/GenerateDataKeyWithoutPlaintext.json

+        },
+        {
+            "technique": "T1496 - Resource Hijacking",
+            "reason": "Attackers could use the symmetric data key to encrypt legitimate resources, thereby disrupting normal operations and potentially leading to financial or operational impacts."


I believe resource hijacking is about using resources from the company, that have an elevated cost in your favor, like cryptocurrency mining, use of AI, or email services. But in this case, you are not using expensive resources that benefit you.

Agreed. I will remove this. I had "Modify Cloud Compute infrastructure" as a potential replacement in mind, but my confidence in that technqiue is low.

adanalvarez · 2024-09-29T11:18:17Z

events/KMS/ScheduleKeyDeletion.json

+        },
+        {
+            "technique": "T1531 - Account Access Removal",
+            "reason": "An adversary may remove access to encrypted data by scheduling the deletion of the KMS key, which is crucial for decryption."


I agree but the account itself continues to have access to the system, just the data is not there ( because of Disk Wipe )

I would have counted that under access removal because it is cryptoshredded, but I will delete it.

events/KMS/ScheduleKeyDeletion.json

adanalvarez · 2024-09-29T11:19:47Z

events/Lambda/AddPermission20150331v2.json

+        },
+        {
+            "technique": "T1070 - Indicator Removal",
+            "reason": "Using AddPermission to adjust access rights can help hide malicious activities by removing or altering indicators of compromise."


I don't see it as strictly related, especially that here you allow somebody else to execute the lambda.

adanalvarez · 2024-09-29T11:21:54Z

events/Lambda/AddPermission20150331v2.json

+        },
+        {
+            "technique": "T1040 - Credential Access via API",
+            "reason": "Granting permissions can facilitate the capture or misuse of credentials if permissions are set incorrectly, allowing access to sensitive functions."


I'm not really sure about this one, also T1040 is Network Sniffing https://attack.mitre.org/techniques/T1040/

I do not know what went in my head. I'll remove it.

adanalvarez · 2024-09-29T11:25:32Z

events/Lambda/CreateFunction20150331.json

+        },
+        {
+            "technique": "T1190 - Exploit Public-Facing Application",
+            "reason": "If the Lambda function is triggered via a public-facing API, it can be exploited to gain initial access or execute code."


I agree with this but seems more related to the invoke than the creation

adanalvarez · 2024-09-29T11:29:48Z

events/Lambda/Invoke.json

+            "technique": "T1027 - Obfuscated Files or Information",
+            "reason": "Attackers might use obfuscation techniques in Lambda functions to hide malicious activities."


The same I tought Exploit Public-Facing Application seems more invoke, I think obfuscate Files or Information seems more CreateFunction as is there when you can create a lambda with obfuscated malicious actions.

Swapped them.

I hhave also included serverless execution as a new technique.

adanalvarez · 2024-09-29T11:30:08Z

events/Lambda/UpdateEventSourceMapping20150331.json

+        },
+        {
+            "technique": "T1106 - Native API",
+            "reason": "Use of the AWS API directly is an example of leveraging native APIs to perform tasks, in this case, updating Lambda functions."


This technique is only for OS application programming interface (API)

adanalvarez · 2024-09-29T11:31:24Z

events/Lambda/UpdateFunctionCode20150331v2.json

+        },
+        {
+            "technique": "T1106 - Native API",
+            "reason": "Directly updating the Lambda function code allows adversaries to exploit native APIs to execute their payloads."


This technique is only for OS application programming interface (API)

adanalvarez · 2024-09-29T11:31:36Z

events/Lambda/UpdateFunctionConfiguration20150331v2.json

+        },
+        {
+            "technique": "T1106 - Native API",
+            "reason": "Attackers use AWS API calls like UpdateFunctionConfiguration to directly interact with and manipulate Lambda functions to achieve their goals."


This technique is only for OS application programming interface (API)

adanalvarez · 2024-10-01T16:53:03Z

events/LightSail/CreateInstances.json

+            "technique": "T1566 - Phishing",
+            "reason": "Instances may host phishing websites to harvest credentials from targeted users."


I think this will be Resource Hijacking as it will be using the service for something malicious

Okay. I will remove it.

adanalvarez · 2024-10-01T16:56:18Z

events/LightSail/CreateInstances.json

+            "technique": "T1583 - Acquire Infrastructure",
+            "reason": "CreateInstances can be used by adversaries to acquire infrastructure for future operations by provisioning new instances."


Interesting, I'm not sure if Resource Development techniques should be part of this.
On the one hand this might be the starting of a new attack, on the other this feels like such an initial tactic does not match an attack that already has initial compromise.

I leave it up to you whether Resource Development techniques should be part of this or not.

adanalvarez · 2024-10-01T17:03:51Z

events/Organizations/InviteAccountToOrganization.json

+            "technique": "T1071 - Application Layer Protocol",
+            "reason": "Using the API call to communicate and manage accounts in the organization can evade detection mechanisms focused on other layers."


I think this is a bit confusing. Because in the end all API calls can be considered Application Layer Protocol.

adanalvarez · 2024-10-01T17:04:29Z

events/Organizations/InviteAccountToOrganization.json

+            "technique": "T1102 - Web Service",
+            "reason": "Utilizing AWS Organizations API as a web service to manage accounts can help in evading direct detection of unauthorized activities."


Similar to Application Layer Protocol, all APIs can be executed from the AWS Console.

adanalvarez · 2024-10-01T17:12:22Z

events/RDS/CreateDBSecurityGroup.json

+            "technique": "T1078 - Valid Accounts",
+            "reason": "Creating a new DB security group could be used to establish persistence by allowing access to specific IP ranges or users who control the security group, effectively allowing continuous access."


I don't see the relationship with the Valid Account

adanalvarez · 2024-10-01T17:18:29Z

events/RDS/DeleteGlobalCluster.json

+            "technique": "T1491 - Defacement",
+            "reason": "The deletion of a global database cluster could serve as a form of defacement, especially if the cluster supports a public-facing application, causing reputational damage."


I don't think we can call this defacement because there is no crafted message. From the technique "Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion"

adanalvarez · 2024-10-01T17:18:46Z

events/RDS/ModifyActivityStream.json

+            "technique": "T1106 - Native API",
+            "reason": "The use of native APIs, such as ModifyActivityStream, can allow an adversary to modify system configurations to evade detection or gain persistence."


This technique is only for OS API

adanalvarez · 2024-10-01T17:21:41Z

events/RDS/ModifyActivityStream.json

+        },
+        {
+            "technique": "T1070 - Indicator Removal",
+            "reason": "By disabling the audit stream, an adversary could attempt to hide or remove traces of malicious activity by preventing the collection of activity logs."


Suggested change

"reason": "By disabling the audit stream, an adversary could attempt to hide or remove traces of malicious activity by preventing the collection of activity logs."

"reason": "Attackers might reconfigure the audit policy state to the original state to avoid an investigation."

Suggestion implemented in next commit.

adanalvarez · 2024-10-01T17:24:19Z

events/RDS/StartExportTask.json

+            "technique": "T1552 - Unsecured Credentials",
+            "reason": "If the database snapshots contain unsecured credentials, such as plaintext passwords or API keys, exporting the snapshot to S3 could allow an adversary to access these credentials, which could then be used to further compromise the environment or exfiltrate additional data."


I agree but I don't see the StartExportTask extrictly related to unsecured credentials.

adanalvarez · 2024-10-01T17:25:57Z

events/RDS/StartExportTask.json

+            "technique": "T1556 - Credentials from Password Stores",
+            "reason": "If the database snapshots contain password hashes or other credential stores, exporting the snapshot to S3 could allow an adversary to collect and crack these credentials for further exploitation."


Similar to Unsecured Credentials, I don't see this related. I agree that after a copy you can probably access and extract sensitive data ( maybe credentials ) but I find it difficult to match with the StartExportTask

adanalvarez · 2024-10-06T09:38:23Z

events/ResourceExplorer/Search.json

+            "technique": "T1027 - Obfuscated Files or Information",
+            "reason": "By using specific query strings, attackers might identify resources where information or files are stored in a manner that obfuscates their true nature, aiding in evasion of detection."


This is not clear to me. I think the technique is about attackers ofuscating information, in this case if attackers identidy obfuscated information this woudn't be a problem.

adanalvarez · 2024-10-06T09:40:15Z

events/Route53/CreateHostedZone.json

+            "technique": "T1087 - Account Discovery",
+            "reason": "The creation of a hosted zone provides attackers with insights into the cloud account structure, domain settings, and associated resources, aiding in further discovery and reconnaissance efforts."


It is not clear to me how creating a new hosted zone, will give insights into the cloud account structure.

adanalvarez · 2024-10-06T09:41:19Z

events/Route53/CreateHostedZone.json

+            "technique": "T1590 - Gather Victim Network Information",
+            "reason": "By setting up a hosted zone and monitoring DNS traffic, attackers can gather information about the victim's network, such as domain structure and internal configurations."


It is not clear to me how creating a new hosted zone, will allow this. It would be weird for normal traffic to go to a new hosted zone if there are no additional actions.

adanalvarez · 2024-10-06T09:41:57Z

events/Route53/CreateHostedZone.json

+            "technique": "T1119 - Automated Collection",
+            "reason": "Hosted zones can be configured to automatically redirect or collect DNS queries from targeted systems, facilitating the collection of sensitive information without direct interaction."


Similar to Gather Victim Network Information I think it would be weird for normal traffic to go to a new hosted zone if there are no additional actions.

adanalvarez · 2024-10-06T09:52:04Z

events/Route53/RegisterDomain.json

+            "technique": "T1070 - Indicator Removal",
+            "reason": "Enabling privacy protection can hide WHOIS information, making it harder to attribute the domain to its true owner, aiding in defense evasion."


I think in this case, as the infra is not yours you do not care if the WHOIS points to the owner of the AWS acccount. As you are registering something new I don't think this can be a indicator removal.

adanalvarez · 2024-10-06T15:15:29Z

events/SSM/GetParameters.json

+            "technique": "T1213 - Data from Information Repositories",
+            "reason": "Attackers can exploit GetParameters to extract important data stored within the Parameter Store, such as system configurations, secrets, or other critical information."


I'm not sure we can consider this a repository.

adanalvarez · 2024-10-06T15:30:00Z

events/TransferFamily/CreateServer.json

+            "technique": "T1505 - Server Software Component",
+            "reason": "By creating a new server, attackers can install or manage software components that support malicious activities, such as maintaining persistence or running unauthorized code."


I don't think this one would work here as the SFTP is just an S3. There is nothing else you can do.

adanalvarez · 2024-10-06T15:34:10Z

events/TransferFamily/CreateServer.json

+            "technique": "T1562 - Impair Defenses",
+            "reason": "Attackers could configure the server in a way that bypasses or disables certain security controls, allowing them to evade detection and maintain access."


For the description

Suggested change

"technique": "T1562 - Impair Defenses",

"reason": "Attackers could configure the server in a way that bypasses or disables certain security controls, allowing them to evade detection and maintain access."

"technique": "T1562 - Impair Defenses",

"reason": "Attackers could configure the server to allow them to access from the internet to S3 files."

Suggestion added in next commit.

adanalvarez · 2024-10-06T15:37:26Z

events/WAFV2/DeleteRuleGroup.json

+        },
+        {
+            "technique": "T1070 - Indicator Removal",
+            "reason": "The deletion of a RuleGroup can be used to eliminate logs or indicators of malicious activity by disabling the mechanisms that detect and log those activities."


Suggested change

"reason": "The deletion of a RuleGroup can be used to eliminate logs or indicators of malicious activity by disabling the mechanisms that detect and log those activities."

"reason": "The deletion of a RuleGroup can be used to eliminate logs or indicators of malicious activity by disabling the mechanisms that detect and log those activities. Also, to delete a group that was used previously by attackers"

Added suggestion to the next commit.

adanalvarez · 2024-10-06T15:39:27Z

events/WAFV2/UpdateIPSet.json

+            "technique": "T1078 - Valid Accounts",
+            "reason": "An attacker with legitimate credentials could update the IPSet to include malicious IPs, ensuring ongoing access or enabling external connections from trusted addresses."


I agree but as mentioned in other techniques, the use of legitimate credentials is needed in all techniques.

adanalvarez

Amazing work! Thanks a lot! LGTM

update TTPs fir AWS Services

9fc3b6a

starting wth A

SaschaDietsch marked this pull request as draft June 15, 2024 15:32

SaschaDietsch added 27 commits June 15, 2024 17:44

forgot Athena

63e57dc

all AWS services starting with B

846bef8

Services starting with C Part 1

a465843

Services starting with C finished

4959b4a

Next is refactoring services from A-C

add new skeleton structure

a6b445c

apply skeleton part 1

111f22c

apply skeleton part 2

ddfa428

update services which start ith A part 1

158d34a

Merge branch 'main' of https://github.com/adanalvarez/TrailDiscover i…

46f554c

…nto improve-ATT&CK-mapping

Update ResumeSession.json

8844877

to add skeleton

populate skeleton till services starting with CC

44aaa33

finish services starting with C.

94358f1

Next are services starting with E

EC2 finished.

889a591

All other services starting with E should not be that long.

ECS, EFS, EKS

0d07944

Resolve conflicts from upstream

f7e239f

ELB and EventBridge finished.

ae1d3c9

Moving to AWS Services starting with G. Those should be Glue and GuardDuty.

finished services starting with G

bc2bddf

Next is IAM

Update UpdateIPSet.json

5b979bc

IAM completed

bc0a8f7

next is KMS

KMS done

a104e4d

Next is Lambda

Finished Services starting with L

6f881dc

Next is the organizations service.

finished Organizations

0a04912

next is RDS and ResourceExplorer

finished services starting with R

f73fd72

Next is S3

S3 finished

6be7159

finished services starting with S

8a792c5

Just a few more entries :)

finished remaining services.

2cc82d8

improve reasons

f6f545b

SaschaDietsch added 2 commits August 31, 2024 13:44

Merge branch 'main' of https://github.com/adanalvarez/TrailDiscover i…

dd24747

…nto improve-ATT&CK-mapping

run toolings

c732cc1

SaschaDietsch marked this pull request as ready for review August 31, 2024 14:17

adanalvarez reviewed Sep 4, 2024

View reviewed changes

implement suggestions

2617eef

and remove other erros - Part 1

Merge branch 'main' of https://github.com/adanalvarez/TrailDiscover i…

b532c17

…nto improve-ATT&CK-mapping

adanalvarez reviewed Sep 24, 2024

View reviewed changes

adanalvarez reviewed Sep 28, 2024

View reviewed changes

adanalvarez reviewed Sep 29, 2024

View reviewed changes

adanalvarez reviewed Oct 1, 2024

View reviewed changes

SaschaDietsch added 2 commits October 5, 2024 19:17

implement feedback and catchup to newest events

b0eb7fd

consume upstream commits

3bc56da

adanalvarez reviewed Oct 6, 2024

View reviewed changes

implemented fedback

46ecc50

adanalvarez approved these changes Oct 12, 2024

View reviewed changes

adanalvarez merged commit f94a27a into adanalvarez:main Oct 12, 2024

		"technique": "T1056.004 - Credential API Hooking",
		"reason": "Attackers may hook into the API key creation process to intercept and use these credentials for unauthorized access."

		"technique": "T1027 - Obfuscated Files or Information",
		"reason": "The API call might be used to modify or obfuscate logs and configurations to avoid detection."

		"technique": "T1027 - Obfuscated Files or Information",
		"reason": "Attackers may use knowledge of logging configurations to craft their actions in ways that avoid triggering specific logging mechanisms."

		"technique": "T1040 - Network Sniffing",
		"reason": "By analyzing flow logs, attackers can infer traffic patterns and potentially sensitive information about network communications"

		"technique": "T1202 - Indirect Command Execution",
		"reason": "By using DescribeImages, attackers can identify images that may allow them to indirectly execute commands through specific software or configurations present in the images"

		"technique": "Using DescribeImages helps attackers discover available cloud services, their configurations, and associated resources.",
		"reason": "Attackers can use DescribeImages to identify and exploit vulnerabilities in the software dependencies and development tools used within specific images, leading to a supply chain compromise"

		"technique": "T1078 - Valid Accounts",
		"reason": "Information obtained from DescribeInstances can help an adversary identify valid user accounts and their associated permissions, especially if they are looking for accounts with elevated privileges."

		"technique": "T1078 - Valid Accounts",
		"reason": "Accessing key pairs allows attackers to use valid credentials to authenticate and access systems, leading to potential unauthorized use of valid accounts."

		"technique": "T1530 - Data from Cloud Storage Object",
		"reason": "If key pairs are stored in cloud storage, an attacker could retrieve these key pairs, potentially leading to unauthorized access."

		"technique": "T1213 - Data from Information Repositories",
		"reason": "DescribeRegions provides metadata about regions, which can be seen as a form of information repository. Attackers may gather this data to understand the environment better."

		"technique": "T1106 - Native API",
		"reason": "Utilizing native AWS APIs to gather configuration data is a method for defense evasion, blending in with regular activity."

		"technique": "T1190 - Exploit Public-Facing Application",
		"reason": ""

		"technique": "T1531 - Account Access Removal",
		"reason": "Modifying snapshot permissions could be used to remove legitimate access, disrupting recovery efforts, and aiding in defense evasion."

		"technique": "T1133 - External Remote Services",
		"reason": "Instances can be accessed and controlled remotely, facilitating initial access and persistent control over the cloud environment through remote services."

		"technique": "T1053 - Scheduled Task/Job",
		"reason": "Attackers could set up scheduled tasks or jobs on the EC2 instance to maintain persistence after gaining access."

		"technique": "T1105 - Ingress Tool Transfer",
		"reason": "Attackers may transfer additional tools to the EC2 instance to facilitate further actions."

		"technique": "T1203 - Exploitation for Client Execution",
		"reason": "Task definitions might be crafted to exploit vulnerabilities within the container runtime or application, leading to execution"

		"technique": "T1531 - Account Access Removal",
		"reason": "Deleting an EFS file system cuts off access to the data for all users and systems that rely on it. This action effectively removes the ability to access critical resources, potentially disrupting operations."

		"technique": "T1496 - Resource Hijacking",
		"reason": "Deleting mount targets can free up resources, potentially redirecting them to other malicious activities or hindering legitimate use, indirectly impacting operations."

		"technique": "T1003 - OS Credential Dumping",
		"reason": "Modifying access policies might allow attackers to gain access to sensitive areas of the system where they can extract credentials."

update TTPs for AWS Services #11

update TTPs for AWS Services #11

Conversation

SaschaDietsch commented Jun 15, 2024 • edited Loading

SaschaDietsch commented Jun 15, 2024

adanalvarez left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SaschaDietsch Sep 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SaschaDietsch commented Sep 6, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SaschaDietsch commented Jun 15, 2024 •

edited

Loading

SaschaDietsch Sep 5, 2024 •

edited

Loading

		"technique": "T1531 - Account Access Removal",
		"reason": "Removing targets from EventBridge rules can prevent specific users or roles from being notified or triggered, effectively removing their access to critical information or actions."

		"technique": "T1106 - Native API",
		"reason": "Using the AWS Glue API to create development endpoints can facilitate malicious actions within the AWS environment by leveraging legitimate service functionalities."

		"technique": "T1484 - Domain or Tenant Policy Modification",
		"reason": "Adversaries can change job definitions to alter the behavior of the Glue job, affecting the overall data processing policies and workflows within the AWS environment."

		"technique": "T1070 - Indicator Removal",
		"reason": "Adversaries can create filters that suppress alerts for file deletion activities, allowing them to remove indicators of their presence without triggering alarms."

	"reason": "Deleting GuardDuty member accounts can prevent legitimate users from accessing the service, thus disrupting monitoring and security alerts."
	"reason": "Deleting GuardDuty member accounts can prevent legitimate accounts from getting data from member accounts, thus disrupting monitoring and security alerts."

		"technique": "Adversaries may use PutUserPolicy to remove access rights for legitimate users, causing disruption.",
		"reason": "If an adversary can modify policies to grant administrative privileges, they effectively escalate their privileges."

	"reason": "Modifying the policy's default version can be used to evade detection by altering the policies that would trigger alarms or logs."
	"reason": "Modifying the policy's default version can be used to evade detection by setting the policy version that was in place before the attack."

	"reason": "Disabling keys can be a tactic to remove indicators of compromise, preventing detection and forensic analysis."
	"reason": "Disabling keys can be a tactic to remove indicators of compromise, because keys need to be disabled before deletion, preventing detection and forensic analysis."

	"reason": "T1036.005] - Masquerading"
	"reason": "Attackers can allow access from an account they control to assume a valid role that is used in the organization making the access appear legitimate"

		"technique": "T1027 - Obfuscated Files or Information",
		"reason": "Attackers might use obfuscation techniques in Lambda functions to hide malicious activities."