https://feed.craftedsignal.io/products/aws-cloudshell/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 04 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-aws-cloudshell-creation/Thu, 04 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-cloudshell-creation/Detection of AWS CloudShell environment creation can indicate unauthorized command execution within AWS by an adversary leveraging a compromised console session to interact with AWS services.AWS CloudShell provides command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when a user launches CloudShell for the first time or accesses CloudShell in a new AWS region. An adversary with compromised console access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI credentials. This can occur even if MFA is enabled for the account if the adversary has already bypassed that control. Monitoring CloudShell environment creation helps detect unauthorized usage from compromised console sessions and is an indicator of potential malicious activity within the AWS environment. The rule focuses on detecting the initial creation of the CloudShell environment via the CreateEnvironment API call.

Attack Chain

1. An attacker gains unauthorized access to an AWS account through compromised credentials or a session hijack (T1078.004).
2. The attacker logs into the AWS Management Console using the compromised account (TA0001).
3. The attacker navigates to the CloudShell service within the AWS Management Console.
4. Since CloudShell hasn't been used before in the AWS region, the CreateEnvironment API is invoked (T1059.009).
5. The attacker uses the CloudShell environment to execute commands and scripts to enumerate AWS resources.
6. The attacker leverages the AWS CLI within CloudShell to create new IAM users or roles with elevated privileges.
7. The attacker uses CloudShell to deploy malicious code or modify existing cloud resources (e.g., S3 buckets, EC2 instances).
8. The attacker attempts to exfiltrate data or establish persistence within the AWS environment using the resources accessed and modified via CloudShell (TA0002).

Impact

A successful attack can lead to unauthorized access to AWS resources, data exfiltration, privilege escalation, and deployment of malicious code within the AWS environment. This can result in data breaches, service disruptions, and financial losses. While the severity is rated low, successful exploitation can lead to significant downstream impact. The impact is highly dependent on the permissions associated with the compromised account used to access CloudShell.

Recommendation

• Deploy the Sigma rule AWS CloudShell Environment Created to detect the initial creation of CloudShell environments in your AWS environment.
• Review aws.cloudtrail.user_identity.arn to identify the IAM principal that created the CloudShell environment.
• Monitor CloudTrail logs for CreateEnvironment events to identify unauthorized CloudShell usage.
• Consider restricting CloudShell access via SCPs or IAM policies for sensitive accounts.
• Enable MFA for all console logins to reduce the risk of session compromise as mentioned in the overview.
• Investigate surrounding activity for any IAM operations after CloudShell was accessed, as outlined in the "Triage and analysis" section of the rule description.

]]>lowadvisoryawscloudshellexecutioninitial-accesshttps://feed.craftedsignal.io/briefs/2024-01-02-aws-cloudshell-iam/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-aws-cloudshell-iam/Compromised AWS console sessions can lead to attackers performing sensitive IAM operations via CloudShell to establish persistence or escalate privileges.AWS CloudShell is a browser-based shell environment that allows command-line access to AWS resources directly from the AWS Management Console. While it offers convenience for administrators, it also presents a risk if an attacker gains access to a compromised console session. An attacker can leverage CloudShell to perform sensitive operations, such as creating IAM users, access keys, and roles, or attaching policies, without the need to install any tools or utilize programmatic credentials. This activity can be indicative of post-compromise credential harvesting or privilege escalation activity within the AWS environment. Defenders should monitor for unusual IAM activity originating from CloudShell sessions, particularly those involving the creation or modification of identities and permissions.

Attack Chain

1. An attacker gains unauthorized access to an AWS Management Console session, potentially through credential theft or session hijacking.
2. The attacker launches AWS CloudShell from within the compromised console session. This provides a command-line interface to the AWS environment.
3. Using the CloudShell environment, the attacker attempts to create a new IAM user with elevated privileges using the aws iam create-user command.
4. The attacker generates a new access key for the newly created IAM user or an existing compromised user with the aws iam create-access-key command.
5. The attacker creates a new IAM role with overly permissive policies attached using the aws iam create-role command.
6. The attacker attaches policies to existing IAM users or roles using the aws iam attach-user-policy or aws iam attach-role-policy commands to escalate privileges.
7. The attacker leverages the newly created or modified IAM identities and access keys to persist in the AWS environment and perform lateral movement.
8. The final objective is to maintain persistent access to the AWS environment, escalate privileges, and potentially exfiltrate sensitive data or cause disruption.

Impact

Successful exploitation can lead to unauthorized access to sensitive AWS resources, data exfiltration, and service disruption. Attackers may create persistent backdoors within the AWS environment through the creation of rogue IAM users or roles. The number of victims depends on the scope of the compromised AWS account. Industries that heavily rely on AWS infrastructure are particularly vulnerable.

Recommendation

• Deploy the Sigma rule AWS IAM Operations via CloudShell to your SIEM and tune for your environment to detect suspicious IAM activity originating from CloudShell sessions.
• Implement session duration limits for AWS Management Console sessions to reduce the window of opportunity for console session abuse.
• Review and restrict CloudShell access via SCPs or IAM policies for sensitive accounts.
• Investigate any ConsoleLogin events followed by IAM actions from CloudShell as described in the rule's description.

]]>mediumadvisorycloudshellawsiampersistenceprivilege-escalationhttps://feed.craftedsignal.io/briefs/2024-01-aws-cloudshell-env-created/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-cloudshell-env-created/The creation of a new AWS CloudShell environment is detected, potentially indicating unauthorized access for command execution within AWS by adversaries without needing local CLI credentials.This detection identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell providing command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console access may abuse CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI credentials. This is especially useful if the attacker is already authenticated into the AWS Console. Monitoring environment creation helps detect unauthorized CloudShell usage stemming from compromised console sessions.

Attack Chain

1. An attacker compromises AWS console credentials through methods such as phishing or credential stuffing.
2. The attacker logs into the AWS Management Console.
3. The attacker navigates to the CloudShell service.
4. The CreateEnvironment API is invoked as the attacker launches CloudShell for the first time in a region.
5. The attacker executes commands within the CloudShell environment to enumerate AWS resources (e.g., using aws s3 ls).
6. The attacker attempts to escalate privileges by exploiting misconfigurations or vulnerabilities.
7. The attacker uses CloudShell to interact with other AWS services, potentially deploying malicious infrastructure or exfiltrating data.
8. The attacker establishes persistence within the AWS environment through methods like creating new IAM users or roles with elevated permissions.

Impact

Successful exploitation via CloudShell can lead to unauthorized access to AWS resources, data exfiltration, and deployment of malicious infrastructure. While the source material does not specify a number of victims, the impact can range from minor data breaches to significant disruptions of AWS-hosted services, depending on the permissions of the compromised account and the attacker's objectives. Even with MFA enabled, sufficiently sophisticated attackers might bypass these protections.

Recommendation

• Deploy the Sigma rule "AWS CloudShell Environment Created" to your SIEM using event.dataset: "aws.cloudtrail" and event.provider: "cloudshell.amazonaws.com" and event.action: "CreateEnvironment" to detect initial environment creation.
• Correlate CloudShell creation events with preceding ConsoleLogin events by reviewing source.ip and user_agent.original to investigate session origin and login context.
• Restrict CloudShell access using Service Control Policies (SCPs) or IAM policies for accounts that do not require it, as mentioned in the overview, to limit the attack surface.

]]>lowadvisorycloudawscloudshell