Cloud abuse technique reference
abusethe.cloud
Learn the attacker idea before the AWS implementation.
Reusable cloud-native offensive techniques, their enabling properties, and validated AWS implementations.
Browse from attacker intent
- ObjectiveWhat capability does the attacker want?
- Technique and primitiveWhat reusable method and enabling boundary produce it?
- ImplementationsWhich AWS mechanisms satisfy the required properties?
All techniques
8 entriesCollect data
Passively collect workload network traffic
Use cloud control-plane configuration to copy selected workload packets outside the workload's user space to a separate collector.
Manipulate workload behavior
Control a VPC's DNS from another AWS account
Attach externally owned DNS configuration so its owner can change answers used by workloads in a target VPC.
Cause destructive impact
Encrypt S3 objects in place with an attacker-held key
Rewrite S3 objects server-side under SSE-C so recovery requires the supplied key, a retained version, or an independent backup.
Shift attribution
Execute AWS actions through a service execution role
Submit attacker-controlled work that performs downstream AWS API calls under a service-operated execution-role session.
Maintain network access
Keep private service access after authorization is revoked
Preserve an established PrivateLink endpoint after its owner loses permission to create new connections.
Collect data
Read S3 through an alternate authorization plane
Create effective S3 data access through Access Grants relationships that are not represented by the bucket policy alone.
Maintain privileged access
Restore privileged IAM state after remediation
Use recurring reconciliation to recreate a privileged IAM identity, policy attachment, and access key after defenders remove them.
Acquire credentials
Acquire renewable workload-role credentials
Turn recurring AWS-managed execution into a renewable source of a useful workload role's temporary sessions.
No techniques match these filters.