Atomic Red Team doc generator
98 lines
5.0 KiB
Markdown
98 lines
5.0 KiB
Markdown
# T1648 - Serverless Execution
|
|
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1648)
|
|
<blockquote>
|
|
|
|
Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
|
|
|
|
Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)
|
|
|
|
Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) This is also possible in many cloud-based office application suites. For example, in Microsoft 365 environments, an adversary may create a Power Automate workflow that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001) In Google Workspace environments, they may instead create an Apps Script that exfiltrates a user's data when they open a file.(Citation: Cloud Hack Tricks GWS Apps Script)(Citation: OWN-CERT Google App Script 2024)
|
|
|
|
</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Lambda Function Hijack](#atomic-test-1---lambda-function-hijack)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Lambda Function Hijack
|
|
Modify an existing Lambda function to execute arbitrary code.
|
|
|
|
**Supported Platforms:** Iaas:aws
|
|
|
|
|
|
**auto_generated_guid:** 87a4a141-c2bb-49d1-a604-8679082d8b91
|
|
|
|
|
|
|
|
|
|
|
|
#### Inputs:
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| access_key | AWS Access Key | string | |
|
|
| secret_key | AWS Secret Key | string | |
|
|
| session_token | AWS Session Token | string | |
|
|
| profile | AWS profile | string | |
|
|
| region | AWS region to deploy the EC2 instance | string | us-east-2|
|
|
|
|
|
|
#### Attack Commands: Run with `powershell`!
|
|
|
|
|
|
```powershell
|
|
Import-Module "PathToAtomicsFolder/T1648/src/T1648-1/LambdaAttack.ps1" -Force
|
|
$access_key = "#{access_key}"
|
|
$secret_key = "#{secret_key}"
|
|
$session_token = "#{session_token}"
|
|
$aws_profile = "#{profile}"
|
|
$region = "#{region}"
|
|
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
|
|
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1"
|
|
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1" -TerraformVariables @("profile=T1648-1", "region=$region")
|
|
Invoke-LambdaAttack -AWSProfile "T1648-1" -AWSRegion $region
|
|
```
|
|
|
|
#### Cleanup Commands:
|
|
```powershell
|
|
Import-Module "PathToAtomicsFolder/T1648/src/T1648-1/LambdaAttack.ps1" -Force
|
|
$access_key = "#{access_key}"
|
|
$secret_key = "#{secret_key}"
|
|
$session_token = "#{session_token}"
|
|
$aws_profile = "#{profile}"
|
|
$region = "#{region}"
|
|
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
|
|
Invoke-Terraform -TerraformCommand destroy -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1" -TerraformVariables @("profile=T1648-1", "region=$region")
|
|
Remove-MaliciousUser -AWSProfile "T1648-1"
|
|
Remove-TFFiles -Path "PathToAtomicsFolder/T1648/src/T1648-1/"
|
|
```
|
|
|
|
|
|
|
|
#### Dependencies: Run with `powershell`!
|
|
##### Description: The AWS PowerShell module must be installed.
|
|
##### Check Prereq Commands:
|
|
```powershell
|
|
try {if (Get-InstalledModule -Name AWSPowerShell -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}
|
|
```
|
|
##### Get Prereq Commands:
|
|
```powershell
|
|
Install-Module -Name AWSPowerShell -Force
|
|
```
|
|
##### Description: Terraform must be installed.
|
|
##### Check Prereq Commands:
|
|
```powershell
|
|
terraform --version
|
|
```
|
|
##### Get Prereq Commands:
|
|
```powershell
|
|
Write-Host "Terraform is required. Download it from https://www.terraform.io/downloads.html"
|
|
```
|
|
|
|
|
|
|
|
|
|
<br/>
|