Threat Technique Catalog for AWS



MITRE Techniques AWS Techniques
Appended or updated MITRE techniques with information on common event names that are logged in Cloudtrail event history as a result of the technique being used; and in most cases, add more detail around methods for detection and options for mitigation. New techniques or sub-techniques to allow us to capture data on the different methods that threat actors are utilizing as part of their unauthorized actions. The catalog will be a continual work-in-progress as techniques and sub-techniques are observed by the AWS CIRT during security events.
Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Impact
Acquire Infrastructure Application API Abuse Cloud Administration Command Account Manipulation Account Manipulation Domain or Tenant Policy Modification Unsecured Credentials Account Discovery Assume Root into Organization Member Account Data from Cloud Storage Account Access Removal
↳ Domains ↳ API Gateway Command and Scripting Interpreter ↳ AWS Support Case Closure ↳ AWS Support Case Closure ↳ Trust Modification ↳ Cloud Instance Metadata API ↳ Cloud Account Domain or Tenant Policy Modification ↳ S3 Object Collection Data Destruction
Cloud Service Dashboard ↳ Cloud API ↳ Additional Cloud Credentials ↳ Additional Cloud Credentials Impair Defenses ↳ Credentials In Files Cloud Database Discovery ↳ Trust Modification Data from Information Repositories ↳ AMI Image Deletion
Exploit Public-Facing Application Serverless Execution ↳ Additional Cloud Roles ↳ Additional Cloud Roles ↳ Disable Cloud Logs ↳ Query RDS EKS Modification - Workload Integrity Degradation ↳ RDS Instance Manipulation ↳ Lifecycle-Triggered Deletion
↳ EC2 Hosted Application Compromise ↳ Invoking Lambda Function ↳ Cognito Refresh Token Abuse ↳ Cognito Refresh Token Abuse ↳ Disable or Modify Cloud Firewall Cloud Service Dashboard Trusted Relationship ↳ RDS Instances and Backups
↳ EKS ↳ Malicious code from Compromised Third Party Packages Application API Abuse Domain or Tenant Policy Modification ↳ Disable or Modify GuardDuty Cloud Storage Discovery ↳ Role Assumption and Federated Access ↳ S3 Object and Bucket Deletion
↳ Overly Permissive VPC Security Groups ↳ API Gateway ↳ Trust Modification Indicator Removal ↳ S3 Object and Bucket Enumeration Data Encrypted for Impact
Trusted Relationship Cloud Service Dashboard Valid Accounts ↳ Delete IAM Entities ↳ EC2/EBS Data Encryption
↳ Role Assumption and Federated Access Create Account ↳ Account Root User Modify Cloud Compute Infrastructure ↳ RDS Data Encryption
Valid Accounts ↳ Create Cloud Account ↳ IAM Users ↳ Create Cloud Instance ↳ S3 Encryption - SSE-C Key Encryption
↳ Account Root User EKS Modification - Workload Integrity Degradation ↳ Create Snapshot Defacement
↳ IAM Users Serverless Execution ↳ Delete Cloud Instance ↳ Subdomain Takeover
↳ Invoking Lambda Function ↳ Modify Cloud Compute Configurations Modify Cloud Compute Infrastructure
↳ Malicious code from Compromised Third Party Packages Modify Cloud Resource Hierarchy ↳ Create Cloud Instance
Trusted Relationship ↳ Create or Invite AWS Account ↳ Create Snapshot
↳ Role Assumption and Federated Access ↳ Invite Accounts to Unknown Organization ↳ Delete Cloud Instance
Valid Accounts ↳ Leave AWS Organization ↳ Modify Cloud Compute Configurations
↳ Account Root User Unused/Unsupported Cloud Regions Resource Hijacking
↳ IAM Users Valid Accounts ↳ Cloud Service Hijacking
↳ Account Root User ↳ Cloud Service Hijacking - Bedrock LLM Abuse
↳ IAM Users ↳ Cloud Service Hijacking - SES Messaging
↳ Compute Hijacking
↳ Compute Hijacking - EC2 Use
↳ Compute Hijacking - ECS
↳ Compute Hijacking - EKS
↳ Compute Hijacking - WorkSpaces
↳ SMS Pumping