Ramesh.8901 retweeted
๐ฟ ๐๐ข๐ฃ๐๐๐ค๐ข๐ง๐ ๐๐ฆ๐๐ณ๐จ๐ง ๐๐ฏ๐๐ง๐ญ๐๐ซ๐ข๐๐ ๐ ๐๐จ๐ซ ๐ฅ๐๐ฎ๐ง๐๐ก๐ข๐ง๐ ๐๐ซ๐จ๐ฌ๐ฌ-๐๐๐๐จ๐ฎ๐ง๐ญ ๐๐ญ๐ญ๐๐๐ค๐ฌ
Square's Ramesh Ramani describes six attack patterns leveraging EventBridge's cross-account capabilities for infiltration and exfiltration.
AWS EventBridge is a serverless event bus service that enables powerful integrations across multiple AWS accounts.
The attacks:
1. Persistent beaconing
2. Command and control
3. Reconnaissance
4. Data smuggling
5. Account hopping
6. API borrowing
The post provides code examples for each attack and recommends multi-layered security controls, including Service Control Policies, IAM permissions, EventBridge resource policies, VPC endpoints with restrictive policies, and event content validation, along with detection strategies using CloudWatch, CloudTrail, and behavioral analytics.
developer.squareup.com/blog/โฆ
#cybersecurity
Ramesh.8901 retweeted
๐๏ธ AWS Security Digest 216 is out!
1๏ธโฃ AWS Account ID Enumeration Through Root User MFA by Michael Magyar
2๏ธโฃ Hijacking Amazon EventBridge for launching Cross-Account attacks by Ramesh Ramani
3๏ธโฃ Sign in with your eID: Using AWS IAM Roles Anywhere with a SmartCard Reader by Ben Bridts
4๏ธโฃ The Future of Threat Emulation: Building AI Agents that Hunt Like Cloud Adversaries by Eduard Agavriloae
5๏ธโฃ Profiling TradeTraitor: Tactics, History & Defenses
Bonus: Stealthy Persistence in AWS - A Practical Simulation for Defenders
awssecuritydigest.com/past-iโฆ
Learn how attackers can misuse Eventbridge and how you can protect your company from these attacks!
We at Block present - Hijacking Amazon EventBridge for launching Cross-Account attacks developer.squareup.com/blog/โฆ
@BlockEng @SquareDev #CloudSecurity #awssecurity #mitreattack
Ramesh.8901 retweeted
๐ Threat Hunting with #Kubernetes Audit Logs by @square
Using ATT&CK for Containers
* Execution: Finding repeated exec failures
* Persistence: Unusual cronjob creation failures
* PrivEsc: Users being given "cluster-admin" access
* + more
developer.squareup.com/blog/โฆ
Ramesh.8901 retweeted
The promised part 2๏ธโฃ of Threat Hunting with Kubernetes Audit Logs is here! @8901Ramesh explains how to use the @MITREattack Framework to hunt for attackers in your @kubernetesio audit logs ๐ฏ #CNCF #Kubernetes
developer.squareup.com/blog/โฆ
Ramesh.8901 retweeted
Threat Hunting with #Kubernetes Audit Logs
developer.squareup.com/blog/โฆ
@nevalau IDE for Kubernetes
github.com/nevalla/lens-resoโฆ
Protect domains that do not send email
gov.uk/guidance/protect-domaโฆ
@chompie1337 Kernel Pwning with eBPF: a Love Story
graplsecurity.com/post/kerneโฆ