Scenario: CloudTrail

Prerequisites

• Playground One Network

Ensure to have the Playground One Network up and running:

# Network configuration
pgo --apply network

Overview

Automated malicious actions are executed on running this scenario which lead to detections in Observed Attack Techniques and the generation of Workbenches.

The story

Using a leaked user with S3 access allows the attacker to list all the buckets and look for buckets where possible sensitive information is stored.

What is going to happen?

This demo is executing the following actions:

1. Preparation
2. Create a S3 Bucket and upload a password.zip.
3. Create an IAM User with S3FullAccess policy.
4. Create an EC2 instance acting as the final target.
5. Attack (using the created user)
6. Create a download directory.
7. Iterate through each bucket (filtered on PGO environment name).
8. List bucket objects.
9. Download bucket object if key matches password.zip and *.pem.
10. Access EC2 instance with downloaded key and query instance role.
11. Clean up
12. Destroy bucket, instance, and user.

Screenshot of generated OATs:

Run the Attack

So, this is very simple :-)

# Create the user, search buckets, download credentials
pgo --apply scenarios-cloudtrail

Outputs:

access_key = "AKIAZHO3CC62YYHHCD6N"
attack = tomap({
  "instance_role" = "pgo-id-ec2-role-24yi5egt"
})
attacker_arn = "arn:aws:iam::634503960501:user/pgo-id-attacker-ragfl318"
instance_ip_linux = "35.158.122.99"
s3_bucket = "pgo-id-scenarios-wk3gd608"
secret_key = <sensitive>

pgo-id-ec2-role-24yi5egt is the role name of the target instance to which the attacker gained access after finding and downloading the ssh key from S3. He connected to the instance and queried it's metadata.

# Delete the user again
pgo --destroy scenarios-cloudtrail

Review the detections in Vision One.

🎉 Success 🎉