Atomic Red Team doc generator
59 lines
2.3 KiB
YAML
59 lines
2.3 KiB
YAML
attack_technique: T1651
|
|
display_name: Cloud Administration Command
|
|
atomic_tests:
|
|
- name: AWS Run Command (and Control)
|
|
auto_generated_guid: a3cc9c95-c160-4b86-af6f-84fba87bfd30
|
|
description: |
|
|
This test simulates an adversary using the AWS Run Command service to execute commands on EC2 instances.
|
|
supported_platforms:
|
|
- iaas:aws
|
|
input_arguments:
|
|
access_key:
|
|
description: AWS Access Key
|
|
type: string
|
|
default: ""
|
|
secret_key:
|
|
description: AWS Secret Key
|
|
type: string
|
|
default: ""
|
|
session_token:
|
|
description: AWS Session Token
|
|
type: string
|
|
default: ""
|
|
profile:
|
|
description: AWS profile
|
|
type: string
|
|
default: ""
|
|
region:
|
|
description: AWS region to deploy the EC2 instance
|
|
type: string
|
|
default: us-east-2
|
|
dependency_executor_name: powershell
|
|
dependencies:
|
|
- description: |
|
|
The AWS PowerShell module must be installed.
|
|
prereq_command: |
|
|
try {if (Get-InstalledModule -Name AWSPowerShell -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}
|
|
get_prereq_command: |
|
|
Install-Module -Name AWSPowerShell -Force
|
|
- description: |
|
|
Terraform must be installed.
|
|
prereq_command: |
|
|
terraform --version
|
|
get_prereq_command: |
|
|
Write-Host "Terraform is required. Download it from https://www.terraform.io/downloads.html"
|
|
executor:
|
|
command: |
|
|
Import-Module "PathToAtomicsFolder/T1651/src/T1651-1/AWSSSMAttack.ps1" -Force
|
|
$access_key = "#{access_key}"
|
|
$secret_key = "#{secret_key}"
|
|
$session_token = "#{session_token}"
|
|
$aws_profile = "#{profile}"
|
|
$region = "#{region}"
|
|
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
|
|
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
|
|
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")
|
|
Invoke-SSMAttack -AWSProfile "T1651-1" -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
|
|
Invoke-Terraform -TerraformCommand destroy -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")
|
|
name: powershell
|