abusethe.cloud documenting AWS abuse techniques

AWS abuse reference

abusethe.cloud

How legitimate AWS features become abuse paths.

A practical reference for reproducing, detecting, and defending against cloud abuse techniques.

Technique index

8 entries

Route 53

Cross-account DNS shadowing through Route 53 Profile grafting

Using a shared Route 53 Profile to make an attacker-owned private hosted zone effective inside another account's VPC.

Impact CreateHostedZone

S3

Cross-account S3 reads through Access Grants authorization

Using an S3 Access Grants instance policy and grant to vend temporary read credentials without changing the bucket policy.

Collection PutAccessGrantsInstanceResourcePolicy

Glue

Glue credential beaconing through scheduled Python jobs

Using scheduled AWS Glue Python shell jobs to collect temporary job-role credentials.

Persistence PutObject

PrivateLink

PrivateLink access persistence through stale endpoint-service trust

Keeping an accepted interface endpoint connected after its AWS principal is removed from an endpoint service allowlist.

Persistence ModifyVpcEndpointServicePermissions

SageMaker

Proxying AWS API calls through SageMaker remote functions

Submitting Python through SageMaker training jobs to shift downstream API activity into an execution-role session and service-operated compute.

Defense Evasion CreateTrainingJob

S3

S3 ransomware through SSE-C self-copy

Using in-place S3 CopyObject requests to encrypt current object versions with an attacker-controlled key that AWS cannot recover.

Impact PutBucketEncryption

Lambda

Self-healing IAM administrator backdoor through Lambda

Using a scheduled Lambda function to recreate an IAM administrator user and beacon each replacement access key.

Persistence CreateFunction20150331

Lambda

Lambda credential beaconing through scheduled functions

Using recurring Lambda invocations to collect temporary AWS credentials.

Persistence CreateFunction20150331