Sub-technique of T1059 Command and Scripting Interpreter.View on attack.mitre.org
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python.
Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.
With proper permissions (often via use of credentials such as Application Access Token and Web Session Cookie), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
Rules on DetectionCode tagged with T1059.009.
| Rule | Level | Log source |
|---|---|---|
| AWS IAM S3Browser LoginProfile Creation | high | aws / NULL |
| AWS IAM S3Browser Templated S3 Bucket Policy Creation | high | aws / NULL |
| AWS IAM S3Browser User or AccessKey Creation | high | aws / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Windows SQL Server Extended Procedure DLL Loading Hunt | Hunting | NULL | Windows Event Log Application 8128 |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT29 | APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API |
| GroupShinyHunters | ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as `ListBuckets`, `CreateBucket` and `DeleteBucket`. |
| GroupStorm-0501 | Storm-0501 has leveraged Cloud CLI to execute commands and exfiltrate data from compromised environments. |
| GroupTeamTNT | TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials. |
| Used by | Procedure example |
|---|---|
| ToolPacu | Pacu leverages the AWS CLI for its operations. |
| ToolTruffleHog | TruffleHog has leveraged Cloud CLI in order to enumerate and gather credentials. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
