AWS Services in Techniques

This page lists all AWS services referenced techniques, along with the associated tactics and techniques.

Services

AWS CloudShell

Technique ID	Technique Name	Tactic(s)
T1059.009	Cloud API	Execution

AWS CloudTrail

Technique ID	Technique Name	Tactic(s)
T1562.008	Disable Cloud Logs	Defense Evasion

AWS IAM Identity Center

Technique ID	Technique Name	Tactic(s)
T1087.004	Cloud Account	Discovery
T1098.003	Additional Cloud Roles	Persistence, Privilege Escalation
T1136.003	Create Cloud Account	Persistence
T1199.A002	Role Assumption and Federated Access	Initial Access, Persistence, Lateral Movement
T1484.002	Trust Modification	Privilege Escalation, Defense Evasion

AWS Identity and Access Management (IAM)

Technique ID	Technique Name	Tactic(s)
T1070.A001	Delete IAM Entities	Defense Evasion
T1078.A001	IAM Users	Initial Access, Persistence, Privilege Escalation, Defense Evasion
T1087.004	Cloud Account	Discovery
T1098.001	Additional Cloud Credentials	Persistence, Privilege Escalation
T1098.003	Additional Cloud Roles	Persistence, Privilege Escalation
T1136.003	Create Cloud Account	Persistence
T1484.002	Trust Modification	Privilege Escalation, Defense Evasion
T1531	Account Access Removal	Impact

AWS Lambda

Technique ID	Technique Name	Tactic(s)
T1648.A001	Invoking Lambda Function	Execution, Persistence

AWS Organizations

Technique ID	Technique Name	Tactic(s)
T1666.A001	Create or Invite AWS Account	Persistence, Defense Evasion, Lateral Movement
T1666.A002	Leave AWS Organization	Defense Evasion

AWS Security Token Service (STS)

Technique ID	Technique Name	Tactic(s)
T1098.001	Additional Cloud Credentials	Persistence, Privilege Escalation
T1199.A002	Role Assumption and Federated Access	Initial Access, Persistence, Lateral Movement

AWS Sign-In

Technique ID	Technique Name	Tactic(s)
T1538	Cloud Service Dashboard	Initial Access, Persistence, Discovery

Amazon API Gateway

Technique ID	Technique Name	Tactic(s)
AT1667.001	API Gateway	Persistence

Amazon Bedrock

Technique ID	Technique Name	Tactic(s)
T1496.A007	Cloud Service Hijacking - Bedrock LLM Abuse	Impact

Amazon CloudWatch

Technique ID	Technique Name	Tactic(s)
T1562.008	Disable Cloud Logs	Defense Evasion

Amazon Cognito

Technique ID	Technique Name	Tactic(s)
T1496.003	SMS Pumping	Impact

Amazon Elastic Compute Cloud (EC2)

Technique ID	Technique Name	Tactic(s)
T1098.001	Additional Cloud Credentials	Persistence, Privilege Escalation
T1496.A008	Compute Hijacking - EC2 Use	Impact
T1552.005	Cloud Instance Metadata API	Credential Access
T1562.007	Disable or Modify Cloud Firewall	Defense Evasion
T1578.001	Create Snapshot	Defense Evasion, Impact
T1578.002	Create Cloud Instance	Defense Evasion, Impact

Amazon Elastic Container Service (ECS)

Technique ID	Technique Name	Tactic(s)
T1496.A006	Compute Hijacking - ECS	Impact
T1578.002	Create Cloud Instance	Defense Evasion, Impact

Amazon Elastic Kubernetes Service (EKS)

Technique ID	Technique Name	Tactic(s)
T1578.002	Create Cloud Instance	Defense Evasion, Impact

Amazon GuardDuty

Technique ID	Technique Name	Tactic(s)
T1562.A001	Disable or Modify GuardDuty	Defense Evasion

Amazon Relational Database Service (RDS)

Technique ID	Technique Name	Tactic(s)
AT1023.001	Query RDS	Discovery
T1213.A013	RDS Instance Manipulation	Initial Access
T1485.A001	RDS Instances and Backups	Impact

Amazon Route 53

Technique ID	Technique Name	Tactic(s)
T1491.A001	Subdomain Takeover	Impact
T1583.001	Domains	Resource Development

Amazon Simple Email Service (SES)

Technique ID	Technique Name	Tactic(s)
T1496.A001	Cloud Service Hijacking - SES Messaging	Impact

Amazon Simple Notification Service (SNS)

Technique ID	Technique Name	Tactic(s)
T1496.003	SMS Pumping	Impact

Amazon Simple Storage Service (S3)

Technique ID	Technique Name	Tactic(s)
T1485.001	Lifecycle-Triggered Deletion	Impact
T1485.A003	S3 Object and Bucket Deletion	Impact
T1486.A001	S3 Encryption - SSE-C Key Encryption	Impact
T1530.A001	S3 Object Collection	Collection
T1619.A001	S3 Object and Bucket Enumeration	Discovery