|
Discovery
The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the AWS environment. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what is around their entry point in order to discover how it could benefit their current objective.
Techniques
Techniques: 7
| ID | Name | Description | |
|---|---|---|---|
| T1087 | Account Discovery |
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). |
|
| ↳ | T1087.004 | Cloud Account |
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. AWS Specific ContentA prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform discovery on IAM users. In AWS, an AWS account is a container where you can create and manage your AWS resources. An account is also a unique identity, typically associated with a user, that grants access to a specific system or resource, for example, an IAM user. This technique is used when a threat actor identifies and enumerates the users and roles that are present within an AWS account, usually performed with the iam:ListUsers or iam:ListRoles action. The threat actor can then use knowledge about the users and roles in attempts to further their objectives. |
| AT1023 | Cloud Database Discovery |
An adversary may attempt to discover resources that are available within database services. |
|
| ↳ | AT1023.001 | Query RDS |
AWS Specific ContentA prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform discovery on RDS resources. With this technique, a threat actor uses actions such as rds:DescribeDBInstances to identify and enumerate the RDS resources that are present within an AWS account. The threat actor can then use knowledge about these resources in attempts to further their objectives, such as changing, reading, retrieving, or destroying data within RDS. |
| T1538 | Cloud Service Dashboard |
An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports. AWS Specific ContentA prerequisite for this technique is that a threat actor has already compromised the login credentials and gained control of an AWS identity with a login profile configured. Alternatively, a threat actor with control over long-term credentials can also generate a URL for access to the AWS Management Console for an IAM user without a login profile configured A Cloud Service Dashboard is a GUI that provides access to cloud services. In AWS, the Cloud Service Dashboard is the AWS Management Console. Using a compromised AWS identity, threat actors can access the identitys AWS account using the AWS Management Console which provides a threat actor with a more intuitive way of navigating the AWS account and a more efficient way to view and interact with resources than with the AWS CLI. Note that the ability to view and access resources are still restricted to the permissions granted to the AWS identity that the threat actor has control over. In some cases, accessing the AWS Management Console will be the Initial Access vector that the threat actor has used to attempt to gain access to the AWS account by obtaining the credentials for a root user, an IAM User, or an AWS IAM Identity Center user. Access to log in to the console is typically granted to an IAM user by creating a login profile and enabling console access, however, threat actors can also utilize scripts to create a URL for IAM users to log on to the AWS Management Console without a login profile. In this scenario, while it is still possible to log in to the AWS Management Console, the ability to view and edit resources in the AWS account is still bound by the permissions granted to the IAM or Identity Center user. |
|
| T1619 | Cloud Storage Discovery |
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. |
|
| ↳ | T1619.A001 | S3 Object and Bucket Enumeration |
AWS Specific ContentA prerequisite for this technique is that a threat actor has already gained control of an AWS identity with the permissions to perform discovery on Amazon S3 resources. Using this technique, a threat actor can identify and enumerate the Amazon S3 objects and buckets that are present within an AWS account. The threat actor can then use knowledge about these resources in attempts to further their objectives, such as changing, reading, retrieving, or destroying data within S3. |