Skip to content

Commit 0381e8b

Browse files
christophetdchristophetd
authored
Add Grimoire detonation datasets (#547)
* Add first iteration of Grimoire detonation datasets to the docs * Fix dataset for SSM attack technique and move log location * Fix dataset * Refactor some attack techniques to properly propagate detonation IDs * Add detonation logs for additional attack techniques * gen docs
1 parent 2a1246d commit 0381e8b

File tree

81 files changed

+25622
-65
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+25622
-65
lines changed

‎docs/attack-techniques/AWS/aws.credential-access.ec2-get-password-data.md

+1,600
Large diffs are not rendered by default.

‎docs/attack-techniques/AWS/aws.credential-access.ec2-steal-instance-credentials.md

+1,858
Large diffs are not rendered by default.

‎docs/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets.md

+218
Original file line numberDiff line numberDiff line change
@@ -96,3 +96,221 @@ The following may be use to tune the detection, or validate findings:
9696
- Attempts to call GetBatchSecretValue resulting in access denied errors
9797
- Principals calling GetBatchSecretValue in several regions in a short period of time
9898

99+
100+
## Detonation logs <span class="smallcaps w3-badge w3-light-green w3-round w3-text-sand">new!</span>
101+
102+
The following CloudTrail events are generated when this technique is detonated[^1]:
103+
104+
105+
- `secretsmanager:BatchGetSecretValue`
106+
107+
108+
??? "View raw detonation logs"
109+
110+
```json hl_lines="6 46 86 126 166"
111+
112+
[
113+
{
114+
"awsRegion": "eu-westwest-1r",
115+
"eventCategory": "Management",
116+
"eventID": "61619dbf-c10b-471e-9d78-8199a2f8233a",
117+
"eventName": "BatchGetSecretValue",
118+
"eventSource": "secretsmanager.amazonaws.com",
119+
"eventTime": "2024-07-31T12:29:17Z",
120+
"eventType": "AwsApiCall",
121+
"eventVersion": "1.09",
122+
"managementEvent": true,
123+
"readOnly": true,
124+
"recipientAccountId": "165109126369",
125+
"requestID": "d493c657-4004-4105-81f0-8f468ba0c9b3",
126+
"requestParameters": {
127+
"filters": [
128+
{
129+
"key": "tag-key",
130+
"values": [
131+
"StratusRedTeam"
132+
]
133+
}
134+
]
135+
},
136+
"responseElements": null,
137+
"sourceIPAddress": "88.223.251.255",
138+
"tlsDetails": {
139+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
140+
"clientProvidedHostHeader": "secretsmanager.eu-westwest-1r.amazonaws.com",
141+
"tlsVersion": "TLSv1.3"
142+
},
143+
"userAgent": "stratus-red-team_0a05817a-84d2-40d7-afde-8311715b1ee6",
144+
"userIdentity": {
145+
"accessKeyId": "AKIALK3Q0HKBKZJ2XBYP",
146+
"accountId": "165109126369",
147+
"arn": "arn:aws:iam::165109126369:user/christophe",
148+
"principalId": "AIDAIOBKTJ7YOYY9TKC4",
149+
"type": "IAMUser",
150+
"userName": "christophe"
151+
}
152+
},
153+
{
154+
"awsRegion": "eu-westwest-1r",
155+
"eventCategory": "Management",
156+
"eventID": "7c7a69f9-867d-4b5b-beee-7fe62ba34d5c",
157+
"eventName": "BatchGetSecretValue",
158+
"eventSource": "secretsmanager.amazonaws.com",
159+
"eventTime": "2024-07-31T12:29:17Z",
160+
"eventType": "AwsApiCall",
161+
"eventVersion": "1.09",
162+
"managementEvent": true,
163+
"readOnly": true,
164+
"recipientAccountId": "165109126369",
165+
"requestID": "6b6e2935-39ad-44d9-9a62-eeb63e95bd69",
166+
"requestParameters": {
167+
"filters": [
168+
{
169+
"key": "tag-key",
170+
"values": [
171+
"StratusRedTeam"
172+
]
173+
}
174+
]
175+
},
176+
"responseElements": null,
177+
"sourceIPAddress": "88.223.251.255",
178+
"tlsDetails": {
179+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
180+
"clientProvidedHostHeader": "secretsmanager.eu-westwest-1r.amazonaws.com",
181+
"tlsVersion": "TLSv1.3"
182+
},
183+
"userAgent": "stratus-red-team_0a05817a-84d2-40d7-afde-8311715b1ee6",
184+
"userIdentity": {
185+
"accessKeyId": "AKIALK3Q0HKBKZJ2XBYP",
186+
"accountId": "165109126369",
187+
"arn": "arn:aws:iam::165109126369:user/christophe",
188+
"principalId": "AIDAIOBKTJ7YOYY9TKC4",
189+
"type": "IAMUser",
190+
"userName": "christophe"
191+
}
192+
},
193+
{
194+
"awsRegion": "eu-westwest-1r",
195+
"eventCategory": "Management",
196+
"eventID": "cf4e352a-b575-4003-bd81-0c531f42e626",
197+
"eventName": "BatchGetSecretValue",
198+
"eventSource": "secretsmanager.amazonaws.com",
199+
"eventTime": "2024-07-31T12:29:17Z",
200+
"eventType": "AwsApiCall",
201+
"eventVersion": "1.09",
202+
"managementEvent": true,
203+
"readOnly": true,
204+
"recipientAccountId": "165109126369",
205+
"requestID": "cd93c41b-cb19-4a2c-9f35-6a1becee24ce",
206+
"requestParameters": {
207+
"filters": [
208+
{
209+
"key": "tag-key",
210+
"values": [
211+
"StratusRedTeam"
212+
]
213+
}
214+
]
215+
},
216+
"responseElements": null,
217+
"sourceIPAddress": "88.223.251.255",
218+
"tlsDetails": {
219+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
220+
"clientProvidedHostHeader": "secretsmanager.eu-westwest-1r.amazonaws.com",
221+
"tlsVersion": "TLSv1.3"
222+
},
223+
"userAgent": "stratus-red-team_0a05817a-84d2-40d7-afde-8311715b1ee6",
224+
"userIdentity": {
225+
"accessKeyId": "AKIALK3Q0HKBKZJ2XBYP",
226+
"accountId": "165109126369",
227+
"arn": "arn:aws:iam::165109126369:user/christophe",
228+
"principalId": "AIDAIOBKTJ7YOYY9TKC4",
229+
"type": "IAMUser",
230+
"userName": "christophe"
231+
}
232+
},
233+
{
234+
"awsRegion": "eu-westwest-1r",
235+
"eventCategory": "Management",
236+
"eventID": "bddee0fb-2541-430d-aad5-b1fdd5d419f1",
237+
"eventName": "BatchGetSecretValue",
238+
"eventSource": "secretsmanager.amazonaws.com",
239+
"eventTime": "2024-07-31T12:29:16Z",
240+
"eventType": "AwsApiCall",
241+
"eventVersion": "1.09",
242+
"managementEvent": true,
243+
"readOnly": true,
244+
"recipientAccountId": "165109126369",
245+
"requestID": "6bd1a472-24d2-46b5-abb6-83a9caf3e3ea",
246+
"requestParameters": {
247+
"filters": [
248+
{
249+
"key": "tag-key",
250+
"values": [
251+
"StratusRedTeam"
252+
]
253+
}
254+
]
255+
},
256+
"responseElements": null,
257+
"sourceIPAddress": "88.223.251.255",
258+
"tlsDetails": {
259+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
260+
"clientProvidedHostHeader": "secretsmanager.eu-westwest-1r.amazonaws.com",
261+
"tlsVersion": "TLSv1.3"
262+
},
263+
"userAgent": "stratus-red-team_0a05817a-84d2-40d7-afde-8311715b1ee6",
264+
"userIdentity": {
265+
"accessKeyId": "AKIALK3Q0HKBKZJ2XBYP",
266+
"accountId": "165109126369",
267+
"arn": "arn:aws:iam::165109126369:user/christophe",
268+
"principalId": "AIDAIOBKTJ7YOYY9TKC4",
269+
"type": "IAMUser",
270+
"userName": "christophe"
271+
}
272+
},
273+
{
274+
"awsRegion": "eu-westwest-1r",
275+
"eventCategory": "Management",
276+
"eventID": "cdc49957-9518-4ab3-a49e-b5a7c17903e6",
277+
"eventName": "BatchGetSecretValue",
278+
"eventSource": "secretsmanager.amazonaws.com",
279+
"eventTime": "2024-07-31T12:29:16Z",
280+
"eventType": "AwsApiCall",
281+
"eventVersion": "1.09",
282+
"managementEvent": true,
283+
"readOnly": true,
284+
"recipientAccountId": "165109126369",
285+
"requestID": "be2e79d0-ef1a-47f1-90b4-bafbbaa7404c",
286+
"requestParameters": {
287+
"filters": [
288+
{
289+
"key": "tag-key",
290+
"values": [
291+
"StratusRedTeam"
292+
]
293+
}
294+
]
295+
},
296+
"responseElements": null,
297+
"sourceIPAddress": "88.223.251.255",
298+
"tlsDetails": {
299+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
300+
"clientProvidedHostHeader": "secretsmanager.eu-westwest-1r.amazonaws.com",
301+
"tlsVersion": "TLSv1.3"
302+
},
303+
"userAgent": "stratus-red-team_0a05817a-84d2-40d7-afde-8311715b1ee6",
304+
"userIdentity": {
305+
"accessKeyId": "AKIALK3Q0HKBKZJ2XBYP",
306+
"accountId": "165109126369",
307+
"arn": "arn:aws:iam::165109126369:user/christophe",
308+
"principalId": "AIDAIOBKTJ7YOYY9TKC4",
309+
"type": "IAMUser",
310+
"userName": "christophe"
311+
}
312+
}
313+
]
314+
```
315+
316+
[^1]: These logs have been gathered from a real detonation of this technique in a test environment using [Grimoire](https://github.com/DataDog/grimoire), and anonymized using [LogLicker](https://github.com/Permiso-io-tools/LogLicker).

0 commit comments

Comments
 (0)