AWS

This page contains the Stratus attack techniques for AWS, grouped by MITRE ATT&CK Tactic. Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic.

Initial Access

• Console Login without MFA

Execution

• Launch Unusual EC2 instances

• Execute Commands on EC2 Instance via User Data

• Usage of ssm:SendCommand on multiple instances

• Usage of ssm:StartSession on multiple instances

Persistence

• Backdoor an IAM Role

• Create an Access Key on an IAM User

• Create an administrative IAM User

• Create a backdoored IAM Role

• Create a Login Profile on an IAM User

• Backdoor Lambda Function Through Resource-Based Policy

• Add a Malicious Lambda Extension

• Overwrite Lambda Function Code

• Create an IAM Roles Anywhere trust anchor

• Generate temporary AWS credentials using GetFederationToken

Privilege Escalation

• Execute Commands on EC2 Instance via User Data

• Create an Access Key on an IAM User

• Create an administrative IAM User

• Create a Login Profile on an IAM User

• Add a Malicious Lambda Extension

• Create an IAM Roles Anywhere trust anchor

• Change IAM user password

Defense Evasion

• Delete CloudTrail Trail

• Disable CloudTrail Logging Through Event Selectors

• CloudTrail Logs Impairment Through S3 Lifecycle Rule

• Stop CloudTrail Trail

• Delete DNS query logs

• Attempt to Leave the AWS Organization

• Remove VPC Flow Logs

Credential Access

• Retrieve EC2 Password Data

• Steal EC2 Instance Credentials

• Retrieve a High Number of Secrets Manager secrets (Batch)

• Retrieve a High Number of Secrets Manager secrets

• Retrieve And Decrypt SSM Parameters

Discovery

• Execute Discovery Commands on an EC2 Instance

• Download EC2 Instance User Data

• Enumerate SES

Lateral Movement

• Usage of EC2 Serial Console to push SSH public key

• Usage of EC2 Instance Connect on multiple instances

Exfiltration

• Open Ingress Port 22 on a Security Group

• Exfiltrate an AMI by Sharing It

• Exfiltrate EBS Snapshot by Sharing It

• Exfiltrate RDS Snapshot by Sharing

• Backdoor an S3 Bucket via its Bucket Policy

Impact

• Invoke Bedrock Model

• S3 Ransomware through batch file deletion

• S3 Ransomware through client-side encryption

• S3 Ransomware through individual file deletion