Skip to content

Commit 2cb34aa

Browse files
MaijinMaijin
committed
feat(targeting): add cloud and container collection/interaction rules
This adds rules for: - enumerating AWS resources (CloudFormation, CloudTrail, DirectConnect, EC2, IAM, S3, Support) - stealing credentials for AWS, GCP, Cloudflare - stealing credentials for Docker and Kubernetes Rules are categorized into host-interaction and collection namespaces.
1 parent 6a0d506 commit 2cb34aa

12 files changed

+301
-0
lines changed

‎collection/cloud/aws/access-aws-credentials.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
rule:
2+
meta:
3+
name: access AWS credentials
4+
namespace: collection/cloud/aws
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Credential Access::Unsecured Credentials::Credentials In Files [T1552.001]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
examples:
15+
- ed40bce040778e2227c869dac59f54c320944e19f77543954f40019e2f2b0c35
16+
features:
17+
- or:
18+
- string: ".aws/config"
19+
- string: ".aws/credentials"
20+
- string: ".aws/credentials.gpg"
21+
- string: ".boto"
22+
- string: ".s3backer_passwd"
23+
- string: ".passwd-s3fs"
24+
- string: "/etc/passwd-s3fs"
25+
- string: ".s3cfg"
26+
- string: "s3proxy.conf"
27+
- string: ".s3ql/authinfo2"

‎collection/cloud/gcp/access-gcp-credentials.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: access GCP credentials
4+
namespace: collection/cloud/gcp
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Credential Access::Unsecured Credentials::Credentials In Files [T1552.001]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
examples:
15+
- ed40bce040778e2227c869dac59f54c320944e19f77543954f40019e2f2b0c35
16+
features:
17+
- or:
18+
- string: ".config/gcloud/access_tokens.db"
19+
- string: ".config/gcloud/credentials.db"

‎collection/cloud/other/access-cloudflare-credentials.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: access Cloudflare credentials
4+
namespace: collection/cloud/other
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: span of calls
10+
att&ck:
11+
- Credential Access::Unsecured Credentials::Credentials In Files [T1552.001]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
examples:
15+
- ed40bce040778e2227c869dac59f54c320944e19f77543954f40019e2f2b0c35
16+
features:
17+
- or:
18+
- string: "/etc/cloudflared/config.yml"

‎collection/container/docker/access-docker-credentials.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
rule:
2+
meta:
3+
name: access Docker credentials
4+
namespace: collection/container/docker
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Credential Access::Unsecured Credentials::Credentials In Files [T1552.001]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
examples:
15+
- ed40bce040778e2227c869dac59f54c320944e19f77543954f40019e2f2b0c35
16+
features:
17+
- or:
18+
- string: ".docker/config.json"
19+
- string: ".docker/ca.pem"

‎collection/container/kubernetes/access-kubernetes-credentials.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
rule:
2+
meta:
3+
name: access Kubernetes credentials
4+
namespace: collection/container/kubernetes
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Credential Access::Unsecured Credentials::Credentials In Files [T1552.001]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
examples:
15+
- ed40bce040778e2227c869dac59f54c320944e19f77543954f40019e2f2b0c35
16+
features:
17+
- or:
18+
- string: "/etc/eksctl/metadata.env"

‎host-interaction/cloud/aws/enumerate-aws-cloudformation.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
rule:
2+
meta:
3+
name: enumerate AWS CloudFormation
4+
namespace: host-interaction/cloud/aws
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Discovery::Cloud Service Discovery [T1526]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
- https://docs.aws.amazon.com/cli/latest/reference/cloudformation/index.html
15+
examples:
16+
- a1e9cd08073e4af3256b31e4b42f3aa69be40862b3988f964e96228f91236593
17+
features:
18+
- or:
19+
- string: "aws cloudformation describe-account-limits"
20+
- string: "aws cloudformation describe-stacks"
21+
- string: "aws cloudformation list-exports"
22+
- string: "aws cloudformation list-stacks"

‎host-interaction/cloud/aws/enumerate-aws-cloudtrail.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule:
2+
meta:
3+
name: enumerate AWS CloudTrail
4+
namespace: host-interaction/cloud/aws
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Discovery::Cloud Service Discovery [T1526]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
- https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/index.html
15+
examples:
16+
- a1e9cd08073e4af3256b31e4b42f3aa69be40862b3988f964e96228f91236593
17+
features:
18+
- or:
19+
- string: "aws cloudtrail describe-trails"
20+
- string: "aws cloudtrail list-public-keys"

‎host-interaction/cloud/aws/enumerate-aws-direct-connect.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
rule:
2+
meta:
3+
name: enumerate AWS Direct Connect
4+
namespace: host-interaction/cloud/aws
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Discovery::Cloud Service Discovery [T1526]
12+
references:
13+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
14+
- https://docs.aws.amazon.com/cli/latest/reference/directconnect/index.html
15+
examples:
16+
- a1e9cd08073e4af3256b31e4b42f3aa69be40862b3988f964e96228f91236593
17+
features:
18+
- or:
19+
- string: "aws directconnect describe-connections"
20+
- string: "aws directconnect describe-interconnects"
21+
- string: "aws directconnect describe-virtual-gateways"
22+
- string: "aws directconnect describe-virtual-interfaces"

‎host-interaction/cloud/aws/enumerate-aws-ec2.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
rule:
2+
meta:
3+
name: enumerate AWS EC2
4+
namespace: host-interaction/cloud/aws
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Discovery::Cloud Service Discovery [T1526]
12+
- Discovery::System Information Discovery [T1082]
13+
- Discovery::System Network Configuration Discovery [T1016]
14+
references:
15+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
16+
- https://docs.aws.amazon.com/cli/latest/reference/ec2/index.html
17+
examples:
18+
- a1e9cd08073e4af3256b31e4b42f3aa69be40862b3988f964e96228f91236593
19+
features:
20+
- or:
21+
- string: "aws ec2 describe-account-attributes"
22+
- string: "aws ec2 describe-addresses"
23+
- string: "aws ec2 describe-bundle-tasks"
24+
- string: "aws ec2 describe-classic-link-instances"
25+
- string: "aws ec2 describe-conversion-tasks"
26+
- string: "aws ec2 describe-customer-gateways"
27+
- string: "aws ec2 describe-dhcp-options"
28+
- string: "aws ec2 describe-export-tasks"
29+
- string: "aws ec2 describe-flow-logs"
30+
- string: "aws ec2 describe-host-reservations"
31+
- string: "aws ec2 describe-hosts"
32+
- string: "aws ec2 describe-images"
33+
- string: "aws ec2 describe-import-image-tasks"
34+
- string: "aws ec2 describe-import-snapshot-tasks"
35+
- string: "aws ec2 describe-instance-status"
36+
- string: "aws ec2 describe-instances"
37+
- string: "aws ec2 describe-internet-gateways"
38+
- string: "aws ec2 describe-key-pairs"
39+
- string: "aws ec2 describe-moving-addresses"
40+
- string: "aws ec2 describe-nat-gateways"
41+
- string: "aws ec2 describe-network-acls"
42+
- string: "aws ec2 describe-network-interfaces"
43+
- string: "aws ec2 describe-placement-groups"
44+
- string: "aws ec2 describe-reserved-instances"
45+
- string: "aws ec2 describe-reserved-instances-listings"
46+
- string: "aws ec2 describe-reserved-instances-modifications"
47+
- string: "aws ec2 describe-route-tables"
48+
- string: "aws ec2 describe-scheduled-instances"
49+
- string: "aws ec2 describe-security-groups"
50+
- string: "aws ec2 describe-snapshots"
51+
- string: "aws ec2 describe-spot-datafeed-subscription"
52+
- string: "aws ec2 describe-spot-fleet-requests"
53+
- string: "aws ec2 describe-spot-instance-requests"
54+
- string: "aws ec2 describe-subnets"
55+
- string: "aws ec2 describe-tags"
56+
- string: "aws ec2 describe-volume-status"
57+
- string: "aws ec2 describe-volumes"
58+
- string: "aws ec2 describe-vpc-classic-link"
59+
- string: "aws ec2 describe-vpc-classic-link-dns-support"
60+
- string: "aws ec2 describe-vpc-endpoints"
61+
- string: "aws ec2 describe-vpc-peering-connections"
62+
- string: "aws ec2 describe-vpcs"
63+
- string: "aws ec2 describe-vpn-connections"
64+
- string: "aws ec2 describe-vpn-gateways"

‎host-interaction/cloud/aws/enumerate-aws-iam.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
rule:
2+
meta:
3+
name: enumerate AWS IAM
4+
namespace: host-interaction/cloud/aws
5+
authors:
6+
- maximemorin@google.com
7+
scopes:
8+
static: function
9+
dynamic: call
10+
att&ck:
11+
- Discovery::Account Discovery::Cloud Account [T1087.004]
12+
- Discovery::Permission Groups Discovery::Cloud Groups [T1069.003]
13+
- Discovery::Cloud Service Discovery [T1526]
14+
references:
15+
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
16+
- https://docs.aws.amazon.com/cli/latest/reference/iam/index.html
17+
examples:
18+
- a1e9cd08073e4af3256b31e4b42f3aa69be40862b3988f964e96228f91236593
19+
features:
20+
- or:
21+
- string: "aws iam get-account-authorization-details"
22+
- string: "aws iam get-account-password-policy"
23+
- string: "aws iam get-account-summary"
24+
- string: "aws iam list-account-aliases"
25+
- string: "aws iam list-groups"
26+
- string: "aws iam list-instance-profiles"
27+
- string: "aws iam list-open-id-connect-providers"
28+
- string: "aws iam list-policies"
29+
- string: "aws iam list-roles"
30+
- string: "aws iam list-saml-providers"
31+
- string: "aws iam list-server-certificates"
32+
- string: "aws iam list-users"
33+
- string: "aws iam list-virtual-mfa-devices"
34+
- string: "aws iam get-credential-report"

0 commit comments

Comments
 (0)