mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
Maijin
f0292fc977
This adds rules for: - enumerating AWS resources (CloudFormation, CloudTrail, DirectConnect, EC2, IAM, S3, Support) - stealing credentials for AWS, GCP, Cloudflare - stealing credentials for Docker and Kubernetes Rules are categorized into host-interaction and collection namespaces.
21 lines
674 B
YAML
21 lines
674 B
YAML
rule:
|
|
meta:
|
|
name: enumerate AWS CloudFormation
|
|
namespace: host-interaction/cloud/aws
|
|
authors:
|
|
- [email protected]
|
|
scopes:
|
|
static: function
|
|
dynamic: call
|
|
att&ck:
|
|
- Discovery::Cloud Service Discovery [T1526]
|
|
references:
|
|
- https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments/
|
|
- https://docs.aws.amazon.com/cli/latest/reference/cloudformation/index.html
|
|
features:
|
|
- or:
|
|
- string: "aws cloudformation describe-account-limits"
|
|
- string: "aws cloudformation describe-stacks"
|
|
- string: "aws cloudformation list-exports"
|
|
- string: "aws cloudformation list-stacks"
|