Threat briefs

This threat brief details the risk of unauthorized or lateral movement via direct AWS Lambda function invocation by non-standard principals, highlighting detection methodologies for cloud environments.

This detection rule identifies suspicious activity in AWS environments where a single principal, from a consistent source IP, rapidly performs read-only S3 control-plane API calls across more than 15 distinct S3 buckets within a 10-second window, indicative of automated reconnaissance, security scanning, or post-compromise enumeration aiming to map S3 bucket access, policies, and versioning.

Adversaries are abusing stolen long-term AWS IAM access keys to perform unauthorized reconnaissance and high-cost model inference within Amazon Bedrock.

Adversaries may delete AWS WAF rules or rule groups via API to impair security boundaries and facilitate follow-on exploitation of web applications.

Adversaries may use the PurgeQueue action in AWS Simple Queue Service (SQS) to permanently delete all messages within a queue to disrupt operations, destroy forensic evidence, or evade detection.

Threat actors with compromised AWS credentials may use RDS restoration operations to duplicate sensitive database environments, facilitating unauthorized data access, staging, and exfiltration while bypassing production monitoring controls.

Adversaries manipulate Amazon GuardDuty member accounts within an AWS organization by using API calls such as `DisassociateFromAdministratorAccount`, `DeleteMembers`, `StopMonitoringMembers`, or `DeleteInvitations` to break centralized security visibility, enabling them to operate undetected in compromised member accounts.

This brief describes a detection capability for identifying potentially unauthorized programmatic access by monitoring for successful AWS IAM long-term access key usage originating from previously unseen source IP addresses.

Detection of unauthorized S3 bucket ACL modifications to public-read or public-read-write by previously unseen identities, potentially indicating credential compromise for data exfiltration.

This brief covers the detection of automated reconnaissance activities, such as vulnerability scanning and fuzzing, which manifest as significant spikes in web server error logs.

Adversaries leverage the POSIX shell 'trap' built-in to bind malicious payloads to interrupt signals, enabling automated execution for persistence or privilege escalation when specific signals are received.

Adversaries may attempt to escalate privileges on Unix-like systems by modifying the sudoers configuration file to grant unauthorized users or groups elevated permissions.

Adversaries may use chmod or install to set SUID or SGID bits on files, allowing malicious code to execute with elevated privileges for persistence or escalation.

Adversaries modify SSH authorized_keys files to establish persistent access and facilitate lateral movement by injecting unauthorized public keys for password-less authentication.

Adversaries maintain persistence on Linux and macOS systems by modifying shell configuration files to execute malicious payloads automatically upon user login or shell session initialization.

This detection rule identifies potential account compromise by correlating three or more distinct machine learning alert triggers associated with the same non-system influencer field.

Detection engineering logic that correlates Elastic Defend endpoint alerts with network security events from PAN-OS, FortiGate, and Suricata to identify potentially compromised hosts based on multi-source telemetry.

This detection capability monitors for lateral movement by identifying sequences where a host IP address from one security alert subsequently appears as the source IP in alerts from a different host.

Detection rule identifies first-time seen USB storage devices mounted on Windows and macOS endpoints to help analysts monitor for potential initial access, lateral movement, or data exfiltration.

This detection logic identifies suspicious subprocess activity originating from software package manager installation processes (npm, pip, uv, poetry, cargo) to surface potential supply-chain compromises.

This detection capability monitors for unauthorized resource hijacking, such as cryptomining or exploit payload execution, by identifying new processes exhibiting sustained CPU usage above 90 percent.

A cross-platform detection methodology correlates security alerts with processes exhibiting sustained high CPU utilization to identify potential resource abuse or post-compromise activity.

This detection logic identifies potentially malicious activity where a Python process rapidly spawns multiple shell commands via '-c' arguments for host profiling, discovery, or lateral movement.

This brief outlines detection logic for identifying reverse shell activity on Unix-like systems by monitoring shell processes for suspicious command-line network device redirection.

Attackers exploit misconfigured privileged containers using host bind-mounts to escape container isolation and gain unauthorized control over the underlying host.

This intelligence brief details a behavioral detection strategy for identifying widespread malware infections by correlating alerts across multiple endpoints to facilitate rapid incident response.

AI coding assistants including OpenClaw, Moltbot, and Clawdbot are being weaponized via malicious 'ClawHub' registry skills to execute unauthorized system commands and exfiltrate cryptocurrency and credential data.

Adversaries are targeting Kubernetes pods to steal service account tokens and certificates, subsequently using them for cluster-wide reconnaissance and lateral movement.

Adversaries may move laterally or perform reconnaissance by compromising a container and using interactive shells or networking utilities to query the Kubernetes API server directly.

This brief outlines detection strategies for unauthorized guest execution via the Azure Virtual Machine Run Command feature, which attackers may abuse to run arbitrary scripts without interactive access.