AWS attack techniques

abusethe.cloud

Understand cloud attacks and how to stop them.

Explore how AWS permissions and services can be misused, what evidence to look for, and which controls limit the damage.

Browse by objective

9 entries

Steal an AWS workload's temporary role credentials to use its permissions from another host.

Maintain a network foothold for persistence after the environment's owner revokes the sharing permission that allowed it.

Maintain privileged access through AWS automation that recreates an IAM user or restores its policy attachment after responders remove it.

Eavesdrop on workload communications by exporting packet copies or connection metadata to another account without an in-guest capture agent.

Exfiltrate S3 data through an external principal authorized by delegated grants or access point policies, without a new bucket policy edit.

Obscure the origin of malicious API activity by running attacker-controlled code under a managed service's execution role.

Evade Session Manager command recording by abusing existing Session Manager and SSH access to an EC2 instance.

Hijack a target VPC's private DNS answers to redirect workloads or cause denial of service through DNS resources controlled by another account.

Encrypt S3 objects with an attacker-held key to hold the data for ransom without downloading it.