1. Home
  2. Tactics
  3. Execution

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on an AWS account/service. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring an AWS environment or stealing data. For example, an adversary might invoke a Lambda function to run a Python script that does IAM Discovery.

Techniques

Techniques: 5
ID Name Description
T1651 Cloud Administration Command

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.

If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environments virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship [MITRE] to execute commands in connected virtual machines.

AWS Specific Content


A prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform the actions in the AWS CloudTrail Event Name(s) section.

Threat actors may take advantage of cloud management and administration services to execute commands within the environment. Resources such as AWS Systems Manager, allow users to remotely run scripts and perform actions on resources within an AWS account and can be used by threat actors to perform unauthorized actions. For example, with access to an AWS identity that has the appropriate permissions, threat actors may abuse cloud management services to execute commands within EC2 instances.
T1059 Command and Scripting Interpreter

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell [MITRE] while Windows installations include the Windows Command Shell [MITRE] and PowerShell [MITRE] .

There are also cross-platform interpreters such as Python [MITRE] , as well as those commonly associated with client applications such as JavaScript [MITRE] and Visual Basic [MITRE] .

Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access [MITRE] payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services [MITRE] in order to achieve remote Execution.

↳ T1059.009 Cloud API

Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell [MITRE] modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python [MITRE] .

Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.

With proper permissions (often via use of credentials such as Application Access Token [MITRE] and Web Session Cookie [MITRE] ), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.

AWS Specific Content


A prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform the actions in the AWS CloudTrail Event Name(s) section.

With access to an AWS identity that has the appropriate permissions, threat actors may abuse cloud APIs to execute unauthorized commands, such as AWS CloudShell. AWS CloudShell, allows users to manage and interact with AWS resources directly from a browser when accessing the AWS Management Console. Actions performed using CloudShell are still restricted by the permissions granted to the identity that is used to invoke the CloudShell environment.
T1648 Serverless Execution

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.

Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. Resource Hijacking [MITRE] ). Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add Additional Cloud Roles [MITRE] to a serverless cloud function, which may then be able to perform actions the original user cannot.

Serverless functions can also be invoked in response to cloud events (i.e. Event Triggered Execution [MITRE] ), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds Additional Cloud Credentials [MITRE] to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created. Similarly, an adversary may create a Power Automate workflow in Office 365 environments that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.

↳ T1648.A001 Invoking Lambda Function

AWS Specific Content


A prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform the action in the Event Name(s) section.

AWS Lambda is a compute service that provides a way to run code without provisioning or managing servers. You can invoke Lambda functions directly with the Lambda console, the Lambda API, the AWS SDK, the AWS CLI, and AWS toolkits. You can also configure other AWS services to invoke a Lambda function, or Lambda can be configured to read from a stream or queue and invoke a function.

With access to an AWS identity that has the appropriate permissions, threat actors may use Lambda to run code in response to events, such as changes to data in an Amazon S3 bucket or an Amazon DynamoDB table; to run code in response to HTTP requests using Amazon API Gateway; or invoke code using API calls made using AWS SDKs.