Skip to content

Commit d57c508

Browse files
adanalvarezchristophetd
adanalvarez
and
christophetd
authored
New attack technique: Persistence through federation (#604)
* add persistence sts federation token technique * add documentation for sts federation token technique * Cosmetic changes + logging improvements * Add delay for eventual consistency * terraform fmt --------- Co-authored-by: Christophe Tafani-Dereeper <[email protected]>
1 parent a912e7f commit d57c508

File tree

8 files changed

+457
-0
lines changed

8 files changed

+457
-0
lines changed

‎docs/attack-techniques/AWS/aws.persistence.sts-federation-token.md

+158
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
---
2+
title: Generate temporary AWS credentials using GetFederationToken
3+
---
4+
5+
# Generate temporary AWS credentials using GetFederationToken
6+
7+
8+
<span class="smallcaps w3-badge w3-blue w3-round w3-text-white" title="This attack technique can be detonated multiple times">idempotent</span>
9+
10+
Platform: AWS
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
17+
## Description
18+
19+
20+
Establishes persistence by generating new AWS temporary credentials through <code>sts:GetFederationToken</code>. The resulting credentials remain functional even if the original access keys are disabled.
21+
22+
<span style="font-variant: small-caps;">Warm-up</span>:
23+
24+
- Create an IAM user and generate a pair of access keys.
25+
26+
<span style="font-variant: small-caps;">Detonation</span>:
27+
28+
- Use the access keys from the IAM user to request temporary security credentials via <code>sts:GetFederationToken</code>.
29+
- Call <code>sts:GetCallerIdentity</code> using these new credentials.
30+
31+
References:
32+
33+
- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html
34+
- https://www.crowdstrike.com/en-us/blog/how-adversaries-persist-with-aws-user-federation/
35+
- https://reinforce.awsevents.com/content/dam/reinforce/2024/slides/TDR432_New-tactics-and-techniques-for-proactive-threat-detection.pdf
36+
- https://fwdcloudsec.org/assets/presentations/2024/europe/sebastian-walla-cloud-conscious-tactics-techniques-and-procedures-an-overview.pdf
37+
38+
39+
## Instructions
40+
41+
```bash title="Detonate with Stratus Red Team"
42+
stratus detonate aws.persistence.sts-federation-token
43+
```
44+
## Detection
45+
46+
47+
Through CloudTrail's <code>GetFederationToken</code> event.
48+
49+
50+
51+
## Detonation logs <span class="smallcaps w3-badge w3-light-green w3-round w3-text-sand">new!</span>
52+
53+
The following CloudTrail events are generated when this technique is detonated[^1]:
54+
55+
56+
- `sts:GetCallerIdentity`
57+
58+
- `sts:GetFederationToken`
59+
60+
61+
??? "View raw detonation logs"
62+
63+
```json hl_lines="6 51"
64+
65+
[
66+
{
67+
"awsRegion": "ap-isob-east-1r",
68+
"eventCategory": "Management",
69+
"eventID": "6e882b9d-2af8-4c67-b91f-aeac6a0e5e70",
70+
"eventName": "GetFederationToken",
71+
"eventSource": "sts.amazonaws.com",
72+
"eventTime": "2024-11-30T08:43:17Z",
73+
"eventType": "AwsApiCall",
74+
"eventVersion": "1.08",
75+
"managementEvent": true,
76+
"readOnly": false,
77+
"recipientAccountId": "742491224508",
78+
"requestID": "e2de7fd1-2a86-4837-b15a-96fff1388061",
79+
"requestParameters": {
80+
"name": "stratus_red_team",
81+
"policy": "{\n\t\t\"Version\": \"2012-10-17\",\n\t\t\"Statement\": [\n\t\t\t{\n\t\t\t\t\"Effect\": \"Allow\",\n\t\t\t\t\"Action\": \"*\",\n\t\t\t\t\"Resource\": \"*\"\n\t\t\t}\n\t\t]\n\t}"
82+
},
83+
"responseElements": {
84+
"credentials": {
85+
"accessKeyId": "ASIASTJKC5GCM7ZE6LUP",
86+
"expiration": "Nov 30, 2024, 8:43:17 PM",
87+
"sessionToken": "IQoJb3JpZ2luX2VjEOH//////////wEaCXVzLWVhc3QtMSJIMEYCIQDzpomGZAmkp4RIzBo4RqVJGEmUNjyA7lHyt1aKfFh8IwIhANX6aS3XpNU319gOolVjEBkNLRmu9dyO8FqoDW5y+HL4KqICCIr//////////wEQABoMMzQ1NTk0NjA3OTQ5IgykqzjqIZ5pQXZgeDEq9gGg9Law7M5zzj/fSvNlo2pgdgHCmA6UW8IevbwXiKbLO5y0dg/sdhsaEUaOvl6i2Fu+xF2p3dvI8SuCJSTH5PEC2ZRgX1TPhzh+0xN7CsCQG2diBitgDQSs+E3P9ED4xDVuTCE9H8IIS/2BuksBI9bQ3z2itKRkVmkC+xpsfyFc98vX0ZLSUKOIpx+iaDNrhiW85Cyt6ezNEyLfX3bukmmIdVIZQ+Tb4tYLvIRKIyp6OFiA3BL48K7nfIAd1EzDhGnlvkZN/70hDxYt8hTKehNXDs2FVKY5u96z0zhsnNGcuhHHa7OEOKg5lLL5QuEzjx6JA+e9qaQwpaCrugY6mAFp1LZ4E15PVqImPSC/wtr+rEU4Dnp+1/6+PNkbxvxYXfqZOfJxRkZtgWtmV7iWapGzA/pVedD4vuHci4Kq2NUTuyA8L7BeKSaEq0FqFi1yrfCYjYsGI3ncxMQQddgiXVXeoWY4c4auGvAHgiJI/PDQPsaa3Sle/gGnok53u8NfNYoBRtASGaJJtGS0ylDxsQVe9InwBxoJnQ=="
88+
},
89+
"federatedUser": {
90+
"arn": "arn:aws:sts::742491224508:federated-user/stratus_red_team",
91+
"federatedUserId": "742491224508:stratus_red_team"
92+
},
93+
"packedPolicySize": 4
94+
},
95+
"sourceIPAddress": "255.090.254.5",
96+
"tlsDetails": {
97+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
98+
"clientProvidedHostHeader": "sts.ap-isob-east-1r.amazonaws.com",
99+
"tlsVersion": "TLSv1.3"
100+
},
101+
"userAgent": "aws-sdk-go-v2/1.32.3 os/linux lang/go#1.23.1 md/GOOS#linux md/GOARCH#amd64 exec-env/grimoire_095724e3-1fa0-4e3e-b68a-e8581d194380 api/sts#1.26.2",
102+
"userIdentity": {
103+
"accessKeyId": "AKIA6V1GNZTT65XQH36M",
104+
"accountId": "742491224508",
105+
"arn": "arn:aws:iam::742491224508:user/stratus-red-team-user-federation-user",
106+
"principalId": "AIDAN7SEM6PEVTNQR8M4",
107+
"type": "IAMUser",
108+
"userName": "stratus-red-team-user-federation-user"
109+
}
110+
},
111+
{
112+
"awsRegion": "ap-isob-east-1r",
113+
"eventCategory": "Management",
114+
"eventID": "91529247-c4c4-4793-afc8-d70bbcfe9d19",
115+
"eventName": "GetCallerIdentity",
116+
"eventSource": "sts.amazonaws.com",
117+
"eventTime": "2024-11-30T08:43:18Z",
118+
"eventType": "AwsApiCall",
119+
"eventVersion": "1.08",
120+
"managementEvent": true,
121+
"readOnly": true,
122+
"recipientAccountId": "742491224508",
123+
"requestID": "037be419-9e9f-42e0-a38f-2a5d2ae1ce65",
124+
"requestParameters": null,
125+
"responseElements": null,
126+
"sourceIPAddress": "255.090.254.5",
127+
"tlsDetails": {
128+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
129+
"clientProvidedHostHeader": "sts.ap-isob-east-1r.amazonaws.com",
130+
"tlsVersion": "TLSv1.3"
131+
},
132+
"userAgent": "aws-sdk-go-v2/1.32.3 os/linux lang/go#1.23.1 md/GOOS#linux md/GOARCH#amd64 exec-env/grimoire_095724e3-1fa0-4e3e-b68a-e8581d194380 api/sts#1.26.2",
133+
"userIdentity": {
134+
"accessKeyId": "ASIASTJKC5GCM7ZE6LUP",
135+
"accountId": "742491224508",
136+
"arn": "arn:aws:sts::742491224508:federated-user/stratus_red_team",
137+
"principalId": "742491224508:stratus_red_team",
138+
"sessionContext": {
139+
"attributes": {
140+
"creationDate": "2024-11-30T08:43:17Z",
141+
"mfaAuthenticated": "false"
142+
},
143+
"sessionIssuer": {
144+
"accountId": "742491224508",
145+
"arn": "arn:aws:iam::742491224508:user/stratus-red-team-user-federation-user",
146+
"principalId": "AIDAN7SEM6PEVTNQR8M4",
147+
"type": "IAMUser",
148+
"userName": "stratus-red-team-user-federation-user"
149+
},
150+
"webIdFederationData": {}
151+
},
152+
"type": "FederatedUser"
153+
}
154+
}
155+
]
156+
```
157+
158+
[^1]: These logs have been gathered from a real detonation of this technique in a test environment using [Grimoire](https://github.com/DataDog/grimoire), and anonymized using [LogLicker](https://github.com/Permiso-io-tools/LogLicker).

‎docs/attack-techniques/AWS/index.md

+2
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,8 @@ Note that some Stratus attack techniques may correspond to more than a single AT
110110

111111
- [Create an IAM Roles Anywhere trust anchor](./aws.persistence.rolesanywhere-create-trust-anchor.md)
112112

113+
- [Generate temporary AWS credentials using GetFederationToken](./aws.persistence.sts-federation-token.md)
114+
113115

114116
## Privilege Escalation
115117

‎docs/attack-techniques/list.md

+1
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ This page contains the list of all Stratus Attack Techniques.
4949
| [Add a Malicious Lambda Extension](./AWS/aws.persistence.lambda-layer-extension.md) | [AWS](./AWS/index.md) | Persistence, Privilege Escalation |
5050
| [Overwrite Lambda Function Code](./AWS/aws.persistence.lambda-overwrite-code.md) | [AWS](./AWS/index.md) | Persistence |
5151
| [Create an IAM Roles Anywhere trust anchor](./AWS/aws.persistence.rolesanywhere-create-trust-anchor.md) | [AWS](./AWS/index.md) | Persistence, Privilege Escalation |
52+
| [Generate temporary AWS credentials using GetFederationToken](./AWS/aws.persistence.sts-federation-token.md) | [AWS](./AWS/index.md) | Persistence |
5253
| [Change IAM user password](./AWS/aws.privilege-escalation.iam-update-user-login-profile.md) | [AWS](./AWS/index.md) | Privilege Escalation |
5354
| [Execute Command on Virtual Machine using Custom Script Extension](./azure/azure.execution.vm-custom-script-extension.md) | [Azure](./azure/index.md) | Execution |
5455
| [Execute Commands on Virtual Machine using Run Command](./azure/azure.execution.vm-run-command.md) | [Azure](./azure/index.md) | Execution |

‎docs/detonation-logs/aws.persistence.sts-federation-token.json

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
[
2+
{
3+
"awsRegion": "ap-isob-east-1r",
4+
"eventCategory": "Management",
5+
"eventID": "6e882b9d-2af8-4c67-b91f-aeac6a0e5e70",
6+
"eventName": "GetFederationToken",
7+
"eventSource": "sts.amazonaws.com",
8+
"eventTime": "2024-11-30T08:43:17Z",
9+
"eventType": "AwsApiCall",
10+
"eventVersion": "1.08",
11+
"managementEvent": true,
12+
"readOnly": false,
13+
"recipientAccountId": "742491224508",
14+
"requestID": "e2de7fd1-2a86-4837-b15a-96fff1388061",
15+
"requestParameters": {
16+
"name": "stratus_red_team",
17+
"policy": "{\n\t\t\"Version\": \"2012-10-17\",\n\t\t\"Statement\": [\n\t\t\t{\n\t\t\t\t\"Effect\": \"Allow\",\n\t\t\t\t\"Action\": \"*\",\n\t\t\t\t\"Resource\": \"*\"\n\t\t\t}\n\t\t]\n\t}"
18+
},
19+
"responseElements": {
20+
"credentials": {
21+
"accessKeyId": "ASIASTJKC5GCM7ZE6LUP",
22+
"expiration": "Nov 30, 2024, 8:43:17 PM",
23+
"sessionToken": "IQoJb3JpZ2luX2VjEOH//////////wEaCXVzLWVhc3QtMSJIMEYCIQDzpomGZAmkp4RIzBo4RqVJGEmUNjyA7lHyt1aKfFh8IwIhANX6aS3XpNU319gOolVjEBkNLRmu9dyO8FqoDW5y+HL4KqICCIr//////////wEQABoMMzQ1NTk0NjA3OTQ5IgykqzjqIZ5pQXZgeDEq9gGg9Law7M5zzj/fSvNlo2pgdgHCmA6UW8IevbwXiKbLO5y0dg/sdhsaEUaOvl6i2Fu+xF2p3dvI8SuCJSTH5PEC2ZRgX1TPhzh+0xN7CsCQG2diBitgDQSs+E3P9ED4xDVuTCE9H8IIS/2BuksBI9bQ3z2itKRkVmkC+xpsfyFc98vX0ZLSUKOIpx+iaDNrhiW85Cyt6ezNEyLfX3bukmmIdVIZQ+Tb4tYLvIRKIyp6OFiA3BL48K7nfIAd1EzDhGnlvkZN/70hDxYt8hTKehNXDs2FVKY5u96z0zhsnNGcuhHHa7OEOKg5lLL5QuEzjx6JA+e9qaQwpaCrugY6mAFp1LZ4E15PVqImPSC/wtr+rEU4Dnp+1/6+PNkbxvxYXfqZOfJxRkZtgWtmV7iWapGzA/pVedD4vuHci4Kq2NUTuyA8L7BeKSaEq0FqFi1yrfCYjYsGI3ncxMQQddgiXVXeoWY4c4auGvAHgiJI/PDQPsaa3Sle/gGnok53u8NfNYoBRtASGaJJtGS0ylDxsQVe9InwBxoJnQ=="
24+
},
25+
"federatedUser": {
26+
"arn": "arn:aws:sts::742491224508:federated-user/stratus_red_team",
27+
"federatedUserId": "742491224508:stratus_red_team"
28+
},
29+
"packedPolicySize": 4
30+
},
31+
"sourceIPAddress": "255.090.254.5",
32+
"tlsDetails": {
33+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
34+
"clientProvidedHostHeader": "sts.ap-isob-east-1r.amazonaws.com",
35+
"tlsVersion": "TLSv1.3"
36+
},
37+
"userAgent": "aws-sdk-go-v2/1.32.3 os/linux lang/go#1.23.1 md/GOOS#linux md/GOARCH#amd64 exec-env/grimoire_095724e3-1fa0-4e3e-b68a-e8581d194380 api/sts#1.26.2",
38+
"userIdentity": {
39+
"accessKeyId": "AKIA6V1GNZTT65XQH36M",
40+
"accountId": "742491224508",
41+
"arn": "arn:aws:iam::742491224508:user/stratus-red-team-user-federation-user",
42+
"principalId": "AIDAN7SEM6PEVTNQR8M4",
43+
"type": "IAMUser",
44+
"userName": "stratus-red-team-user-federation-user"
45+
}
46+
},
47+
{
48+
"awsRegion": "ap-isob-east-1r",
49+
"eventCategory": "Management",
50+
"eventID": "91529247-c4c4-4793-afc8-d70bbcfe9d19",
51+
"eventName": "GetCallerIdentity",
52+
"eventSource": "sts.amazonaws.com",
53+
"eventTime": "2024-11-30T08:43:18Z",
54+
"eventType": "AwsApiCall",
55+
"eventVersion": "1.08",
56+
"managementEvent": true,
57+
"readOnly": true,
58+
"recipientAccountId": "742491224508",
59+
"requestID": "037be419-9e9f-42e0-a38f-2a5d2ae1ce65",
60+
"requestParameters": null,
61+
"responseElements": null,
62+
"sourceIPAddress": "255.090.254.5",
63+
"tlsDetails": {
64+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
65+
"clientProvidedHostHeader": "sts.ap-isob-east-1r.amazonaws.com",
66+
"tlsVersion": "TLSv1.3"
67+
},
68+
"userAgent": "aws-sdk-go-v2/1.32.3 os/linux lang/go#1.23.1 md/GOOS#linux md/GOARCH#amd64 exec-env/grimoire_095724e3-1fa0-4e3e-b68a-e8581d194380 api/sts#1.26.2",
69+
"userIdentity": {
70+
"accessKeyId": "ASIASTJKC5GCM7ZE6LUP",
71+
"accountId": "742491224508",
72+
"arn": "arn:aws:sts::742491224508:federated-user/stratus_red_team",
73+
"principalId": "742491224508:stratus_red_team",
74+
"sessionContext": {
75+
"attributes": {
76+
"creationDate": "2024-11-30T08:43:17Z",
77+
"mfaAuthenticated": "false"
78+
},
79+
"sessionIssuer": {
80+
"accountId": "742491224508",
81+
"arn": "arn:aws:iam::742491224508:user/stratus-red-team-user-federation-user",
82+
"principalId": "AIDAN7SEM6PEVTNQR8M4",
83+
"type": "IAMUser",
84+
"userName": "stratus-red-team-user-federation-user"
85+
},
86+
"webIdFederationData": {}
87+
},
88+
"type": "FederatedUser"
89+
}
90+
}
91+
]

‎docs/index.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,13 @@ AWS:
294294
- Privilege Escalation
295295
platform: AWS
296296
isIdempotent: false
297+
- id: aws.persistence.sts-federation-token
298+
name: Generate temporary AWS credentials using GetFederationToken
299+
isSlow: false
300+
mitreAttackTactics:
301+
- Persistence
302+
platform: AWS
303+
isIdempotent: true
297304
Privilege Escalation:
298305
- id: aws.execution.ec2-user-data
299306
name: Execute Commands on EC2 Instance via User Data

0 commit comments

Comments
 (0)