Skip to content

Commit a0361a8

Browse files
kmcquadekmcquade
authored
Merge pull request #49 from rstalets/main
Documentation & Terraform Fix
2 parents 5f73a58 + 38006f8 commit a0361a8

17 files changed

+202
-4
lines changed

‎docs/risks/ebs.md

+9
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,15 @@ After an EBS Snapshot is made public, an attacker can then:
7070

7171
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
7272

73+
## Basic Detection
74+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
75+
```
76+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
77+
| filter eventSource='ec2.amazonaws.com' and (eventName='ModifySnapshotAttribute' and requestParameters.attributeType='CREATE_VOLUME_PERMISSION')
78+
```
79+
80+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
81+
7382
## References
7483

7584
* [Sharing an Unencrypted Snapshot using the Console](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html#share-unencrypted-snapshot)

‎docs/risks/ec2-amis.md

+9
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,15 @@ After an EC2 AMI is made public, an attacker can then:
6363

6464
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
6565

66+
## Basic Detection
67+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
68+
```
69+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
70+
| filter eventSource='ec2.amazonaws.com' and (eventName='ModifyImageAttribute' and requestParameters.attributeType='launchPermission')
71+
```
72+
73+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
74+
6675
## References
6776

6877
- [aws ec2 modify-image-attribute](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html)

‎docs/risks/ecr.md

+16
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,22 @@ TODO
8080

8181
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
8282

83+
## Basic Detection
84+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
85+
```
86+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
87+
| filter eventSource='ecr.amazonaws.com' and (eventName='SetRepositoryPolicy' or eventName='DeleteRepositoryPolicy'
88+
or eventName='PutRegistryPolicy' or eventName='DeleteRegistryPolicy')
89+
```
90+
91+
The following query detects policy modifications which include the default IOC string:
92+
```
93+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
94+
| filter eventSource='ecr.amazonaws.com' and (eventName='SetRepositoryPolicy' and responseElements.policyText like 'Endgame')
95+
```
96+
97+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
98+
8399
## References
84100

85101
* [set-repository-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ecr/set-repository-policy.html)

‎docs/risks/elasticfilesystem.md

+15
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,21 @@ TODO
9494

9595
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
9696

97+
## Basic Detection
98+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
99+
```
100+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
101+
| filter eventSource='elasticfilesystem.amazonaws.com' and eventName='PutFileSystemPolicy'
102+
```
103+
104+
The following query detects policy modifications which include the default IOC string:
105+
```
106+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
107+
| filter eventSource='elasticfilesystem.amazonaws.com' and (eventName='PutFileSystemPolicy' and requestParameters.policy like 'Endgame')
108+
```
109+
110+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
111+
97112
## References
98113

99114
* [put-filesystem-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/put-file-system-policy.html)

‎docs/risks/elasticsearch.md

+9
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,15 @@ However, if **Public Access** _is_ necessary, follow the steps below to remediat
4343

4444
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
4545

46+
## Basic Detection
47+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
48+
```
49+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
50+
| filter eventSource='es.amazonaws.com' and eventName='UpdateElasticsearchDomainConfig'
51+
```
52+
53+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
54+
4655
## References
4756

4857
* [ElasticSearch Resource-based Policies](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-ac.html#es-ac-types-resource)

‎docs/risks/glacier.md

+15
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,21 @@ TODO
5454

5555
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
5656

57+
## Basic Detection
58+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
59+
```
60+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
61+
| filter eventSource='glacier.amazonaws.com' and eventName='SetVaultAccessPolicy'
62+
```
63+
64+
The following query detects policy modifications which include the default IOC string:
65+
```
66+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
67+
| filter eventSource='glacier.amazonaws.com' and (eventName='SetVaultAccessPolicy' and requestParameters.policy.policy like 'Endgame')
68+
```
69+
70+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
71+
5772
## References
5873

5974
* [set-vault-access-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/glacier/set-vault-access-policy.html)

‎docs/risks/iam.md

+11-1
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,16 @@ aws sts get-caller-identity
163163

164164
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
165165

166+
## Basic Detection
167+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
168+
```
169+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
170+
| filter eventSource='iam.amazonaws.com' and eventName='UpdateAssumeRolePolicy'
171+
```
172+
173+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
174+
166175
## References
167176

168-
* [update-assume-role-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html)
177+
* [update-assume-role-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/update-assume-role-policy.html)
178+
* [Learn more about IAM cross-account trust](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html)

‎docs/risks/kms.md

+15
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,21 @@ TODO
5959

6060
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
6161

62+
## Basic Detection
63+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
64+
```
65+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
66+
| filter eventSource='kms.amazonaws.com' and eventName='PutKeyPolicy'
67+
```
68+
69+
The following query detects policy modifications which include the default IOC string:
70+
```
71+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
72+
| filter eventSource='kms.amazonaws.com' and (eventName='PutKeyPolicy' and requestParameters.policy like 'Endgame')
73+
```
74+
75+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
76+
6277
## References
6378

6479
* [put-key-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kms/put-key-policy.html)

‎docs/risks/lambda-functions.md

+15
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,21 @@ aws lambda invoke --function-name $VICTIM_LAMBDA
9191

9292
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
9393

94+
## Basic Detection
95+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
96+
```
97+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
98+
| filter eventSource='lambda.amazonaws.com' and eventName like 'AddPermission'
99+
```
100+
101+
The following query detects policy modifications which include the default IOC string:
102+
```
103+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
104+
| filter eventSource='lambda.amazonaws.com' and (eventName like 'AddPermission' and requestParameters.statementId='Endgame')
105+
```
106+
107+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
108+
94109
## References
95110

96111
* [aws lambda add-permission](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/add-permission.html)

‎docs/risks/rds-snapshots.md

+11-2
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,20 @@ After the RDS snapshot is public or shared with the rogue user account, an attac
5757
- [rds:DescribeDbClusterSnapshots](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterSnapshots.html): _Grants permission to return information about DB cluster snapshots._
5858
- [rds:DescribeDbSnapshotAttributes](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSnapshotAttributes.html): _Grants permission to return a list of DB snapshot attribute names and values for a manual DB snapshot. This includes information on which AWS Accounts have access to the snapshot._
5959
- [rds:DescribeDbSnapshots](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSnapshots.html): _Grants permission to return information about DB snapshots_
60-
- [rds:ModifyDbSnapshotAttribute](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshotAttribute.html): _Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB snapshot. This includes the ability to share snapshots with other AWS Accounts._
61-
- [rds:ModifyDbClusterSnapshotAttribute](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterSnapshotAttribute.html): _Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot. This includes the ability to share snapshots with other AWS Accounts._
60+
- [rds:ModifyDBSnapshotAttribute](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshotAttribute.html): _Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB snapshot. This includes the ability to share snapshots with other AWS Accounts._
61+
- [rds:ModifyDBClusterSnapshotAttribute](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterSnapshotAttribute.html): _Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot. This includes the ability to share snapshots with other AWS Accounts._
6262

6363
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
6464

65+
## Basic Detection
66+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
67+
```
68+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
69+
| filter eventSource='rds.amazonaws.com' AND (eventName='ModifyDBSnapshotAttribute' or eventName='ModifyDBClusterSnapshotAttribute' and requestParameters.attributeName='restore')
70+
```
71+
72+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
73+
6574
## References
6675

6776
- [aws rds modify-db-cluster-snapshot-attribute](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-cluster-snapshot-attribute.html)

‎docs/risks/s3.md

+16
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,22 @@ TODO
4848

4949
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
5050

51+
## Basic Detection
52+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
53+
```
54+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
55+
| filter eventSource='s3.amazonaws.com' AND eventName='PutBucketPolicy'
56+
```
57+
58+
The following query detects policy modifications which include the default IOC string:
59+
```
60+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
61+
| filter eventSource='s3.amazonaws.com' AND (eventName='PutBucketPolicy' and @message like 'Endgame')
62+
```
63+
(More specific queries related to the policy contents do not work due to how CWL parses the requestParameters object on these calls)
64+
65+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
66+
5167
## References
5268

5369
- [aws s3api put-bucket-policy](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html)

‎docs/risks/secretsmanager.md

+15
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,21 @@ aws secretsmanager get-secret-value --secret-id $VICTIM_RESOURCE
9090

9191
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
9292

93+
## Basic Detection
94+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
95+
```
96+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
97+
| filter eventSource='secretsmanager.amazonaws.com' AND (eventName='PutResourcePolicy' or eventName='DeleteResourcePolicy')
98+
```
99+
100+
The following query detects policy modifications which include the default IOC string:
101+
```
102+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
103+
| filter eventSource='secretsmanager.amazonaws.com' AND (eventName='PutResourcePolicy' and requestParameters.resourcePolicy like 'Endgame')
104+
```
105+
106+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
107+
93108
## References
94109

95110
* [aws secretsmanager get-resource-policy](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/get-resource-policy.html)

‎docs/risks/ses.md

+15
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,21 @@ The policy below allows the Evil Principal (`arn:aws:iam::999988887777:user/evil
7474

7575
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
7676

77+
## Basic Detection
78+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
79+
```
80+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
81+
| filter eventSource='ses.amazonaws.com' AND (eventName='PutIdentityPolicy' or eventName='DeleteIdentityPolicy')
82+
```
83+
84+
The following query detects policy modifications which include the default IOC string:
85+
```
86+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
87+
| filter eventSource='ses.amazonaws.com' AND (eventName='PutIdentityPolicy' and requestParameters.policyName='Endgame')
88+
```
89+
90+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
91+
7792
## References
7893

7994
* [put-identity-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ses/put-identity-policy.html)

‎docs/risks/sns.md

+9
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,15 @@ TODO
8989

9090
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
9191

92+
## Basic Detection
93+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
94+
```
95+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
96+
| filter eventSource='ses.amazonaws.com' AND (eventName='PutIdentityPolicy' or eventName='DeleteIdentityPolicy')
97+
```
98+
99+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
100+
92101
## References
93102

94103
* [add-permission](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sns/add-permission.html)

‎docs/risks/sqs.md

+9
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,15 @@ TODO
5454

5555
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
5656

57+
## Basic Detection
58+
The following CloudWatch Log Insights query will include exposure actions taken by endgame:
59+
```
60+
fields eventTime, eventSource, eventName, userIdentity.arn, userAgent
61+
| filter eventSource='sqs.amazonaws.com' AND (eventName='AddPermission' or eventName='RemovePermission')
62+
```
63+
64+
This query assumes that your CloudTrail logs are being sent to CloudWatch and that you have selected the correct log group.
65+
5766
## References
5867

5968
* [aws sqs add-permission](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sqs/add-permission.html)

0 commit comments

Comments
 (0)