cloudg 0.3.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- cloudg/__init__.py +21 -0
- cloudg/api.py +613 -0
- cloudg/cli.py +934 -0
- cloudg/collectors/__init__.py +5 -0
- cloudg/collectors/aws.py +830 -0
- cloudg/collectors/azure.py +362 -0
- cloudg/collectors/base.py +44 -0
- cloudg/collectors/gcp.py +170 -0
- cloudg/collectors/multi.py +329 -0
- cloudg/config.py +261 -0
- cloudg/coverage.py +93 -0
- cloudg/credentials.py +451 -0
- cloudg/graph/__init__.py +6 -0
- cloudg/graph/builder.py +336 -0
- cloudg/graph/ontology.py +914 -0
- cloudg/graph/rag_export.py +533 -0
- cloudg/graph/reachability.py +237 -0
- cloudg/normaliser.py +390 -0
- cloudg/policies/custodian-aws-security.yml +139 -0
- cloudg/policies/custodian-azure.yml +95 -0
- cloudg/policies/custodian-gcp.yml +87 -0
- cloudg/policies/custodian.yml +131 -0
- cloudg/region_discovery.py +330 -0
- cloudg/registry.py +142 -0
- cloudg/renderers/__init__.py +1 -0
- cloudg/renderers/html_report.py +430 -0
- cloudg/renderers/json_export.py +65 -0
- cloudg/renderers/svg.py +689 -0
- cloudg/renderers/terraform_export.py +666 -0
- cloudg/retry.py +103 -0
- cloudg/rules/cis_aws_v3.yaml +148 -0
- cloudg/rules/cis_azure_v2.yaml +142 -0
- cloudg/rules/cis_gcp_v3.yaml +133 -0
- cloudg/rules/frameworks/aws_foundational_security_best_practices_aws.yaml +1286 -0
- cloudg/rules/frameworks/cis_5.0_aws.yaml +280 -0
- cloudg/rules/frameworks/cis_5.0_azure.yaml +475 -0
- cloudg/rules/frameworks/cis_5.0_gcp.yaml +327 -0
- cloudg/rules/frameworks/gdpr_aws.yaml +95 -0
- cloudg/rules/frameworks/hipaa_aws.yaml +461 -0
- cloudg/rules/frameworks/hipaa_azure.yaml +504 -0
- cloudg/rules/frameworks/hipaa_gcp.yaml +211 -0
- cloudg/rules/frameworks/iso27001_2022_aws.yaml +789 -0
- cloudg/rules/frameworks/iso27001_2022_azure.yaml +477 -0
- cloudg/rules/frameworks/iso27001_2022_gcp.yaml +240 -0
- cloudg/rules/frameworks/mitre_attack_aws.yaml +596 -0
- cloudg/rules/frameworks/mitre_attack_azure.yaml +418 -0
- cloudg/rules/frameworks/mitre_attack_gcp.yaml +300 -0
- cloudg/rules/frameworks/nist_800_53_revision_5_aws.yaml +3234 -0
- cloudg/rules/frameworks/nist_csf_2.0_aws.yaml +828 -0
- cloudg/rules/frameworks/pci_4.0_aws.yaml +7108 -0
- cloudg/rules/frameworks/pci_4.0_azure.yaml +4696 -0
- cloudg/rules/frameworks/pci_4.0_gcp.yaml +5405 -0
- cloudg/rules/frameworks/soc2_aws.yaml +421 -0
- cloudg/rules/frameworks/soc2_azure.yaml +477 -0
- cloudg/rules/frameworks/soc2_gcp.yaml +342 -0
- cloudg/rules/gdpr.yaml +56 -0
- cloudg/rules/hipaa_security_rule.yaml +83 -0
- cloudg/rules/iso_27001_2022.yaml +88 -0
- cloudg/rules/nist_800_53.yaml +134 -0
- cloudg/rules/pci_dss_v4.yaml +108 -0
- cloudg/rules/soc2_tsc.yaml +93 -0
- cloudg/scanners/__init__.py +1 -0
- cloudg/scanners/checkov.py +174 -0
- cloudg/scanners/iam_linter.py +200 -0
- cloudg/scanners/prowler.py +237 -0
- cloudg/scanners/scoutsuite.py +163 -0
- cloudg/scanners/trivy.py +339 -0
- cloudg/schema/__init__.py +25 -0
- cloudg/schema/models.py +260 -0
- cloudg/templates/report.html.j2 +828 -0
- cloudg-0.3.0.dist-info/METADATA +330 -0
- cloudg-0.3.0.dist-info/RECORD +75 -0
- cloudg-0.3.0.dist-info/WHEEL +4 -0
- cloudg-0.3.0.dist-info/entry_points.txt +14 -0
- cloudg-0.3.0.dist-info/licenses/LICENSE +21 -0
|
@@ -0,0 +1,596 @@
|
|
|
1
|
+
# Generated by scripts/import_prowler_compliance.py — do not edit by hand.
|
|
2
|
+
# Framework: MITRE-ATTACK (AWS)
|
|
3
|
+
# Data source: Prowler (https://github.com/prowler-cloud/prowler), Apache-2.0.
|
|
4
|
+
framework: MITRE-ATTACK-AWS
|
|
5
|
+
version: null
|
|
6
|
+
source: Prowler compliance data (mitre_attack_aws.json), Apache-2.0, https://github.com/prowler-cloud/prowler
|
|
7
|
+
provider: aws
|
|
8
|
+
controls:
|
|
9
|
+
- id: T1190
|
|
10
|
+
title: Adversaries may attempt to exploit a weakness in an Internet-facing host
|
|
11
|
+
or system to initially access a network. The weakness in the system can be a software
|
|
12
|
+
bug, a temporary glitch, or a misconfiguration.
|
|
13
|
+
checks:
|
|
14
|
+
- awslambda_function_not_publicly_accessible
|
|
15
|
+
- config_recorder_all_regions_enabled
|
|
16
|
+
- drs_job_exist
|
|
17
|
+
- ec2_confidential_workload_host_public_ip
|
|
18
|
+
- ec2_confidential_workload_host_vsock_proxy_exposed
|
|
19
|
+
- ec2_instance_public_ip
|
|
20
|
+
- elbv2_waf_acl_attached
|
|
21
|
+
- guardduty_is_enabled
|
|
22
|
+
- inspector2_active_findings_exist
|
|
23
|
+
- inspector2_is_enabled
|
|
24
|
+
- rds_instance_backup_enabled
|
|
25
|
+
- rds_instance_minor_version_upgrade_enabled
|
|
26
|
+
- securityhub_enabled
|
|
27
|
+
- id: T1199
|
|
28
|
+
title: Adversaries may breach or otherwise leverage organizations who have access
|
|
29
|
+
to intended victims. Access through trusted third party relationship abuses an
|
|
30
|
+
existing connection that may not be protected or receives less scrutiny than standard
|
|
31
|
+
mechanisms of gaining access to a network.
|
|
32
|
+
checks:
|
|
33
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
34
|
+
- ec2_networkacl_allow_ingress_tcp_port_22
|
|
35
|
+
- ec2_networkacl_allow_ingress_tcp_port_3389
|
|
36
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_all_ports
|
|
37
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
38
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
|
|
39
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888
|
|
40
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601
|
|
41
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21
|
|
42
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
|
|
43
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
|
|
44
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
|
|
45
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
|
|
46
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483
|
|
47
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
|
|
48
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
|
|
49
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434
|
|
50
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23
|
|
51
|
+
- id: T1078
|
|
52
|
+
title: Adversaries may obtain and abuse credentials of existing accounts as a means
|
|
53
|
+
of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
|
|
54
|
+
Compromised credentials may be used to bypass access controls placed on various
|
|
55
|
+
resources on systems within the network and may even be used…
|
|
56
|
+
checks:
|
|
57
|
+
- config_recorder_all_regions_enabled
|
|
58
|
+
- guardduty_is_enabled
|
|
59
|
+
- iam_administrator_access_with_mfa
|
|
60
|
+
- iam_avoid_root_usage
|
|
61
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
62
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
63
|
+
- iam_customer_unattached_policy_no_administrative_privileges
|
|
64
|
+
- iam_inline_policy_no_administrative_privileges
|
|
65
|
+
- iam_no_custom_policy_permissive_role_assumption
|
|
66
|
+
- iam_no_expired_server_certificates_stored
|
|
67
|
+
- iam_no_root_access_key
|
|
68
|
+
- iam_password_policy_expires_passwords_within_90_days_or_less
|
|
69
|
+
- iam_password_policy_lowercase
|
|
70
|
+
- iam_password_policy_minimum_length_14
|
|
71
|
+
- iam_password_policy_number
|
|
72
|
+
- iam_password_policy_reuse_24
|
|
73
|
+
- iam_password_policy_symbol
|
|
74
|
+
- iam_password_policy_uppercase
|
|
75
|
+
- iam_policy_allows_privilege_escalation
|
|
76
|
+
- iam_policy_no_full_access_to_cloudtrail
|
|
77
|
+
- iam_policy_no_full_access_to_kms
|
|
78
|
+
- iam_role_access_not_stale_to_bedrock
|
|
79
|
+
- iam_role_cross_account_readonlyaccess_policy
|
|
80
|
+
- iam_role_cross_service_confused_deputy_prevention
|
|
81
|
+
- iam_root_hardware_mfa_enabled
|
|
82
|
+
- iam_root_mfa_enabled
|
|
83
|
+
- iam_rotate_access_key_90_days
|
|
84
|
+
- iam_user_access_not_stale_to_bedrock
|
|
85
|
+
- iam_user_access_not_stale_to_sagemaker
|
|
86
|
+
- iam_user_accesskey_unused
|
|
87
|
+
- iam_user_console_access_unused
|
|
88
|
+
- iam_user_hardware_mfa_enabled
|
|
89
|
+
- iam_user_mfa_enabled_console_access
|
|
90
|
+
- iam_user_no_setup_initial_access_key
|
|
91
|
+
- iam_user_two_active_access_key
|
|
92
|
+
- kms_key_enclave_attestation_bypassable_path
|
|
93
|
+
- kms_key_enclave_attestation_unknown_image
|
|
94
|
+
- organizations_account_part_of_organizations
|
|
95
|
+
- organizations_delegated_administrators
|
|
96
|
+
- organizations_scp_check_deny_regions
|
|
97
|
+
- securityhub_enabled
|
|
98
|
+
- id: T1059
|
|
99
|
+
title: Adversaries may abuse command and script interpreters to execute commands,
|
|
100
|
+
scripts, or binaries. These interfaces and languages provide ways of interacting
|
|
101
|
+
with computer systems and are a common feature across many different platforms.
|
|
102
|
+
Most systems come with some built-in command-line interface and…
|
|
103
|
+
checks:
|
|
104
|
+
- elbv2_waf_acl_attached
|
|
105
|
+
- id: T1648
|
|
106
|
+
title: Adversaries may abuse serverless computing, integration, and automation services
|
|
107
|
+
to execute arbitrary code in cloud environments. Many cloud providers offer a
|
|
108
|
+
variety of serverless resources, including compute engines, application integration
|
|
109
|
+
services, and web servers.
|
|
110
|
+
checks:
|
|
111
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
112
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
113
|
+
- iam_inline_policy_no_administrative_privileges
|
|
114
|
+
- iam_policy_allows_privilege_escalation
|
|
115
|
+
- iam_policy_no_full_access_to_cloudtrail
|
|
116
|
+
- iam_policy_no_full_access_to_kms
|
|
117
|
+
- id: T1204
|
|
118
|
+
title: An adversary may rely upon specific actions by a user in order to gain execution.
|
|
119
|
+
Users may be subjected to social engineering to get them to execute malicious
|
|
120
|
+
code by, for example, opening a malicious document file or link. These user actions
|
|
121
|
+
will typically be observed as follow-on behavior from f…
|
|
122
|
+
checks:
|
|
123
|
+
- config_recorder_all_regions_enabled
|
|
124
|
+
- id: T1098
|
|
125
|
+
title: Adversaries may manipulate accounts to maintain access to victim systems.
|
|
126
|
+
Account manipulation may consist of any action that preserves adversary access
|
|
127
|
+
to a compromised account, such as modifying credentials or permission groups.
|
|
128
|
+
These actions could also include account activity designed to subver…
|
|
129
|
+
checks:
|
|
130
|
+
- config_recorder_all_regions_enabled
|
|
131
|
+
- guardduty_is_enabled
|
|
132
|
+
- iam_administrator_access_with_mfa
|
|
133
|
+
- iam_avoid_root_usage
|
|
134
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
135
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
136
|
+
- iam_inline_policy_no_administrative_privileges
|
|
137
|
+
- iam_no_custom_policy_permissive_role_assumption
|
|
138
|
+
- iam_policy_allows_privilege_escalation
|
|
139
|
+
- iam_policy_no_full_access_to_cloudtrail
|
|
140
|
+
- iam_policy_no_full_access_to_kms
|
|
141
|
+
- iam_root_hardware_mfa_enabled
|
|
142
|
+
- iam_root_mfa_enabled
|
|
143
|
+
- iam_user_hardware_mfa_enabled
|
|
144
|
+
- iam_user_mfa_enabled_console_access
|
|
145
|
+
- securityhub_enabled
|
|
146
|
+
- id: T1136
|
|
147
|
+
title: Adversaries may create an account to maintain access to victim systems. With
|
|
148
|
+
a sufficient level of access, creating such accounts may be used to establish
|
|
149
|
+
secondary credentialed access that do not require persistent remote access tools
|
|
150
|
+
to be deployed on the system.
|
|
151
|
+
checks:
|
|
152
|
+
- config_recorder_all_regions_enabled
|
|
153
|
+
- id: T1525
|
|
154
|
+
title: Adversaries may implant cloud or container images with malicious code to
|
|
155
|
+
establish persistence after gaining access to an environment. Amazon Web Services
|
|
156
|
+
(AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure
|
|
157
|
+
Images as well as popular container runtimes such as Docker ca…
|
|
158
|
+
checks:
|
|
159
|
+
- config_recorder_all_regions_enabled
|
|
160
|
+
- id: T1556
|
|
161
|
+
title: Adversaries may modify authentication mechanisms and processes to access
|
|
162
|
+
user credentials or enable otherwise unwarranted access to accounts. The authentication
|
|
163
|
+
process is handled by mechanisms, such as the Local Security Authentication Server
|
|
164
|
+
(LSASS) process and the Security Accounts Manager (SAM)…
|
|
165
|
+
checks:
|
|
166
|
+
- iam_root_hardware_mfa_enabled
|
|
167
|
+
- iam_root_mfa_enabled
|
|
168
|
+
- iam_user_hardware_mfa_enabled
|
|
169
|
+
- iam_user_mfa_enabled_console_access
|
|
170
|
+
- id: T1562
|
|
171
|
+
title: Adversaries may maliciously modify components of a victim environment in
|
|
172
|
+
order to hinder or disable defensive mechanisms. This not only involves impairing
|
|
173
|
+
preventative defenses, such as firewalls and anti-virus, but also detection capabilities
|
|
174
|
+
that defenders can use to audit activity and identify m…
|
|
175
|
+
checks:
|
|
176
|
+
- config_recorder_all_regions_enabled
|
|
177
|
+
- guardduty_is_enabled
|
|
178
|
+
- inspector2_active_findings_exist
|
|
179
|
+
- inspector2_is_enabled
|
|
180
|
+
- kms_key_enclave_debug_attestation_detected
|
|
181
|
+
- securityhub_enabled
|
|
182
|
+
- id: T1578
|
|
183
|
+
title: An adversary may attempt to modify a cloud account's compute service infrastructure
|
|
184
|
+
to evade defenses. A modification to the compute service infrastructure can include
|
|
185
|
+
the creation, deletion, or modification of one or more components such as compute
|
|
186
|
+
instances, virtual machines, and snapshots.
|
|
187
|
+
checks:
|
|
188
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
189
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
190
|
+
- iam_inline_policy_no_administrative_privileges
|
|
191
|
+
- iam_policy_allows_privilege_escalation
|
|
192
|
+
- iam_policy_no_full_access_to_cloudtrail
|
|
193
|
+
- iam_policy_no_full_access_to_kms
|
|
194
|
+
- id: T1535
|
|
195
|
+
title: Adversaries may create cloud instances in unused geographic service regions
|
|
196
|
+
in order to evade detection. Access is usually obtained through compromising accounts
|
|
197
|
+
used to manage cloud infrastructure.
|
|
198
|
+
checks:
|
|
199
|
+
- organizations_scp_check_deny_regions
|
|
200
|
+
- id: T1550
|
|
201
|
+
title: Adversaries may use alternate authentication material, such as password hashes,
|
|
202
|
+
Kerberos tickets, and application access tokens, in order to move laterally within
|
|
203
|
+
an environment and bypass normal system access controls.
|
|
204
|
+
checks:
|
|
205
|
+
- iam_administrator_access_with_mfa
|
|
206
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
207
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
208
|
+
- iam_inline_policy_no_administrative_privileges
|
|
209
|
+
- iam_no_root_access_key
|
|
210
|
+
- iam_policy_allows_privilege_escalation
|
|
211
|
+
- iam_policy_no_full_access_to_cloudtrail
|
|
212
|
+
- iam_policy_no_full_access_to_kms
|
|
213
|
+
- iam_root_hardware_mfa_enabled
|
|
214
|
+
- iam_root_mfa_enabled
|
|
215
|
+
- iam_rotate_access_key_90_days
|
|
216
|
+
- iam_user_accesskey_unused
|
|
217
|
+
- iam_user_console_access_unused
|
|
218
|
+
- iam_user_hardware_mfa_enabled
|
|
219
|
+
- iam_user_mfa_enabled_console_access
|
|
220
|
+
- iam_user_no_setup_initial_access_key
|
|
221
|
+
- iam_user_two_active_access_key
|
|
222
|
+
- id: T1110
|
|
223
|
+
title: Adversaries may use brute force techniques to gain access to accounts when
|
|
224
|
+
passwords are unknown or when password hashes are obtained. Without knowledge
|
|
225
|
+
of the password for an account or set of accounts, an adversary may systematically
|
|
226
|
+
guess the password using a repetitive or iterative mechanism. B…
|
|
227
|
+
checks:
|
|
228
|
+
- config_recorder_all_regions_enabled
|
|
229
|
+
- guardduty_is_enabled
|
|
230
|
+
- iam_password_policy_expires_passwords_within_90_days_or_less
|
|
231
|
+
- iam_password_policy_lowercase
|
|
232
|
+
- iam_password_policy_minimum_length_14
|
|
233
|
+
- iam_password_policy_number
|
|
234
|
+
- iam_password_policy_reuse_24
|
|
235
|
+
- iam_password_policy_symbol
|
|
236
|
+
- iam_password_policy_uppercase
|
|
237
|
+
- iam_root_hardware_mfa_enabled
|
|
238
|
+
- iam_root_mfa_enabled
|
|
239
|
+
- iam_rotate_access_key_90_days
|
|
240
|
+
- iam_user_accesskey_unused
|
|
241
|
+
- iam_user_console_access_unused
|
|
242
|
+
- iam_user_hardware_mfa_enabled
|
|
243
|
+
- iam_user_mfa_enabled_console_access
|
|
244
|
+
- inspector2_active_findings_exist
|
|
245
|
+
- inspector2_is_enabled
|
|
246
|
+
- securityhub_enabled
|
|
247
|
+
- id: T1606
|
|
248
|
+
title: Adversaries may forge credential materials that can be used to gain access
|
|
249
|
+
to web applications or Internet services. Web applications and services (hosted
|
|
250
|
+
in cloud SaaS environments or on-premise servers) often use session cookies, tokens,
|
|
251
|
+
or other materials to authenticate and authorize user acces…
|
|
252
|
+
checks:
|
|
253
|
+
- iam_no_custom_policy_permissive_role_assumption
|
|
254
|
+
- iam_policy_allows_privilege_escalation
|
|
255
|
+
- id: T1040
|
|
256
|
+
title: Adversaries may sniff network traffic to capture information about an environment,
|
|
257
|
+
including authentication material passed over the network. Network sniffing refers
|
|
258
|
+
to using the network interface on a system to monitor or capture information sent
|
|
259
|
+
over a wired or wireless connection. An adversary m…
|
|
260
|
+
checks:
|
|
261
|
+
- acm_certificates_expiration_check
|
|
262
|
+
- cloudfront_distributions_https_enabled
|
|
263
|
+
- cloudwatch_log_group_kms_encryption_enabled
|
|
264
|
+
- config_recorder_all_regions_enabled
|
|
265
|
+
- elb_ssl_listeners
|
|
266
|
+
- elbv2_ssl_listeners
|
|
267
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
268
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
269
|
+
- iam_inline_policy_no_administrative_privileges
|
|
270
|
+
- iam_no_custom_policy_permissive_role_assumption
|
|
271
|
+
- iam_policy_allows_privilege_escalation
|
|
272
|
+
- iam_root_hardware_mfa_enabled
|
|
273
|
+
- iam_root_mfa_enabled
|
|
274
|
+
- iam_user_hardware_mfa_enabled
|
|
275
|
+
- iam_user_mfa_enabled_console_access
|
|
276
|
+
- rds_instance_transport_encrypted
|
|
277
|
+
- s3_bucket_secure_transport_policy
|
|
278
|
+
- id: T1552
|
|
279
|
+
title: Adversaries may search compromised systems to find and obtain insecurely
|
|
280
|
+
stored credentials. These credentials can be stored and/or misplaced in many locations
|
|
281
|
+
on a system, including plaintext files (e.g. Bash History), operating system or
|
|
282
|
+
application-specific repositories (e.g. Credentials in Regi…
|
|
283
|
+
checks:
|
|
284
|
+
- autoscaling_find_secrets_ec2_launch_configuration
|
|
285
|
+
- awslambda_function_no_secrets_in_code
|
|
286
|
+
- awslambda_function_no_secrets_in_variables
|
|
287
|
+
- cloudformation_stack_outputs_find_secrets
|
|
288
|
+
- cloudwatch_log_group_no_secrets_in_logs
|
|
289
|
+
- ec2_confidential_workload_host_imdsv2_not_enforced
|
|
290
|
+
- ec2_instance_imdsv2_enabled
|
|
291
|
+
- ec2_instance_secrets_user_data
|
|
292
|
+
- ec2_launch_template_no_secrets
|
|
293
|
+
- ecs_task_definitions_no_environment_secrets
|
|
294
|
+
- eks_cluster_kms_cmk_encryption_in_secrets_enabled
|
|
295
|
+
- guardduty_is_enabled
|
|
296
|
+
- kms_key_enclave_attestation_not_enforced
|
|
297
|
+
- macie_is_enabled
|
|
298
|
+
- secretsmanager_automatic_rotation_enabled
|
|
299
|
+
- ssm_document_secrets
|
|
300
|
+
- id: T1048
|
|
301
|
+
title: Adversaries may steal data by exfiltrating it over a different protocol than
|
|
302
|
+
that of the existing command and control channel. The data may also be sent to
|
|
303
|
+
an alternate network location from the main command and control server.
|
|
304
|
+
checks:
|
|
305
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
306
|
+
- ec2_networkacl_allow_ingress_tcp_port_22
|
|
307
|
+
- ec2_networkacl_allow_ingress_tcp_port_3389
|
|
308
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_all_ports
|
|
309
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
310
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
|
|
311
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888
|
|
312
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601
|
|
313
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21
|
|
314
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
|
|
315
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
|
|
316
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
|
|
317
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
|
|
318
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483
|
|
319
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
|
|
320
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
|
|
321
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434
|
|
322
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23
|
|
323
|
+
- guardduty_is_enabled
|
|
324
|
+
- networkfirewall_in_all_vpc
|
|
325
|
+
- id: T1537
|
|
326
|
+
title: Adversaries may exfiltrate data by transferring the data, including backups
|
|
327
|
+
of cloud environments, to another cloud account they control on the same service
|
|
328
|
+
to avoid typical file transfers/downloads and network-based exfiltration detection.
|
|
329
|
+
checks:
|
|
330
|
+
- macie_is_enabled
|
|
331
|
+
- id: T1119
|
|
332
|
+
title: Once established within a system or network, an adversary may use automated
|
|
333
|
+
techniques for collecting internal data. Methods for performing this technique
|
|
334
|
+
could include use of a Command and Scripting Interpreter to search for and copy
|
|
335
|
+
information fitting set criteria such as file type, location, or…
|
|
336
|
+
checks:
|
|
337
|
+
- config_recorder_all_regions_enabled
|
|
338
|
+
- ec2_ebs_default_encryption
|
|
339
|
+
- ec2_ebs_snapshots_encrypted
|
|
340
|
+
- ec2_ebs_volume_encryption
|
|
341
|
+
- rds_instance_storage_encrypted
|
|
342
|
+
- s3_bucket_default_encryption
|
|
343
|
+
- id: T1530
|
|
344
|
+
title: Adversaries may collect sensitive data from these cloud storage solutions.
|
|
345
|
+
Providers typically offer security guides to help end users configure systems,
|
|
346
|
+
though misconfigurations are a common problem.[5][6][7] There have been numerous
|
|
347
|
+
incidents where cloud storage has been improperly secured, typic…
|
|
348
|
+
checks:
|
|
349
|
+
- config_recorder_all_regions_enabled
|
|
350
|
+
- dynamodb_accelerator_cluster_encryption_enabled
|
|
351
|
+
- dynamodb_tables_kms_cmk_encryption_enabled
|
|
352
|
+
- efs_encryption_at_rest_enabled
|
|
353
|
+
- efs_not_publicly_accessible
|
|
354
|
+
- emr_cluster_publicly_accesible
|
|
355
|
+
- macie_is_enabled
|
|
356
|
+
- networkfirewall_in_all_vpc
|
|
357
|
+
- rds_instance_no_public_access
|
|
358
|
+
- rds_instance_storage_encrypted
|
|
359
|
+
- rds_instance_transport_encrypted
|
|
360
|
+
- rds_snapshots_public_access
|
|
361
|
+
- redshift_cluster_public_access
|
|
362
|
+
- s3_account_level_public_access_blocks
|
|
363
|
+
- s3_bucket_default_encryption
|
|
364
|
+
- s3_bucket_level_public_access_block
|
|
365
|
+
- s3_bucket_public_access
|
|
366
|
+
- sagemaker_notebook_instance_encryption_enabled
|
|
367
|
+
- sagemaker_notebook_instance_without_direct_internet_access_configured
|
|
368
|
+
- sagemaker_training_jobs_intercontainer_encryption_enabled
|
|
369
|
+
- securityhub_enabled
|
|
370
|
+
- sns_topics_kms_encryption_at_rest_enabled
|
|
371
|
+
- id: T1485
|
|
372
|
+
title: Adversaries may destroy data and files on specific systems or in large numbers
|
|
373
|
+
on a network to interrupt availability to systems, services, and network resources.
|
|
374
|
+
Data destruction is likely to render stored data irrecoverable by forensic techniques
|
|
375
|
+
through overwriting files or data on local and rem…
|
|
376
|
+
checks:
|
|
377
|
+
- backup_plans_exist
|
|
378
|
+
- cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
|
|
379
|
+
- config_recorder_all_regions_enabled
|
|
380
|
+
- drs_job_exist
|
|
381
|
+
- dynamodb_tables_pitr_enabled
|
|
382
|
+
- efs_have_backup_enabled
|
|
383
|
+
- rds_instance_backup_enabled
|
|
384
|
+
- rds_instance_deletion_protection
|
|
385
|
+
- s3_bucket_no_mfa_delete
|
|
386
|
+
- s3_bucket_object_lock
|
|
387
|
+
- s3_bucket_object_versioning
|
|
388
|
+
- s3_bucket_policy_public_write_access
|
|
389
|
+
- id: T1486
|
|
390
|
+
title: Adversaries may encrypt data on target systems or on large numbers of systems
|
|
391
|
+
in a network to interrupt availability to system and network resources. They can
|
|
392
|
+
attempt to render stored data inaccessible by encrypting files or data on local
|
|
393
|
+
and remote drives and withholding access to a decryption key…
|
|
394
|
+
checks:
|
|
395
|
+
- backup_plans_exist
|
|
396
|
+
- config_recorder_all_regions_enabled
|
|
397
|
+
- drs_job_exist
|
|
398
|
+
- dynamodb_tables_pitr_enabled
|
|
399
|
+
- efs_have_backup_enabled
|
|
400
|
+
- rds_instance_backup_enabled
|
|
401
|
+
- s3_bucket_object_lock
|
|
402
|
+
- s3_bucket_object_versioning
|
|
403
|
+
- s3_bucket_policy_public_write_access
|
|
404
|
+
- id: T1491
|
|
405
|
+
title: Adversaries may modify visual content available internally or externally
|
|
406
|
+
to an enterprise network, thus affecting the integrity of the original content.
|
|
407
|
+
Reasons for Defacement include delivering messaging, intimidation, or claiming
|
|
408
|
+
(possibly false) credit for an intrusion. Disturbing or offensive i…
|
|
409
|
+
checks:
|
|
410
|
+
- config_recorder_all_regions_enabled
|
|
411
|
+
- drs_job_exist
|
|
412
|
+
- id: T1499
|
|
413
|
+
title: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade
|
|
414
|
+
or block the availability of services to users. Endpoint DoS can be performed
|
|
415
|
+
by exhausting the system resources those services are hosted on or exploiting
|
|
416
|
+
the system to cause a persistent crash condition. Example services …
|
|
417
|
+
checks:
|
|
418
|
+
- config_recorder_all_regions_enabled
|
|
419
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
420
|
+
- ec2_networkacl_allow_ingress_tcp_port_22
|
|
421
|
+
- ec2_networkacl_allow_ingress_tcp_port_3389
|
|
422
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_all_ports
|
|
423
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
424
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
|
|
425
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888
|
|
426
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601
|
|
427
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21
|
|
428
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
|
|
429
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
|
|
430
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
|
|
431
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
|
|
432
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483
|
|
433
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
|
|
434
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
|
|
435
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434
|
|
436
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23
|
|
437
|
+
- networkfirewall_in_all_vpc
|
|
438
|
+
- shield_advanced_protection_in_associated_elastic_ips
|
|
439
|
+
- shield_advanced_protection_in_classic_load_balancers
|
|
440
|
+
- shield_advanced_protection_in_cloudfront_distributions
|
|
441
|
+
- shield_advanced_protection_in_global_accelerators
|
|
442
|
+
- shield_advanced_protection_in_internet_facing_load_balancers
|
|
443
|
+
- shield_advanced_protection_in_route53_hosted_zones
|
|
444
|
+
- id: T1490
|
|
445
|
+
title: Adversaries may delete or remove built-in data and turn off services designed
|
|
446
|
+
to aid in the recovery of a corrupted system to prevent recovery.[1][2] This may
|
|
447
|
+
deny access to available backups and recovery options.
|
|
448
|
+
checks:
|
|
449
|
+
- drs_job_exist
|
|
450
|
+
- rds_instance_backup_enabled
|
|
451
|
+
- id: T1496
|
|
452
|
+
title: Adversaries may leverage the resources of co-opted systems in order to solve
|
|
453
|
+
resource intensive problems, which may impact system and/or hosted service availability.
|
|
454
|
+
checks:
|
|
455
|
+
- cloudwatch_changes_to_network_acls_alarm_configured
|
|
456
|
+
- cloudwatch_changes_to_network_gateways_alarm_configured
|
|
457
|
+
- cloudwatch_changes_to_network_route_tables_alarm_configured
|
|
458
|
+
- cloudwatch_changes_to_vpcs_alarm_configured
|
|
459
|
+
- cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled
|
|
460
|
+
- cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled
|
|
461
|
+
- cloudwatch_log_metric_filter_authentication_failures
|
|
462
|
+
- cloudwatch_log_metric_filter_aws_organizations_changes
|
|
463
|
+
- cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
|
|
464
|
+
- cloudwatch_log_metric_filter_for_s3_bucket_policy_changes
|
|
465
|
+
- cloudwatch_log_metric_filter_policy_changes
|
|
466
|
+
- cloudwatch_log_metric_filter_root_usage
|
|
467
|
+
- cloudwatch_log_metric_filter_security_group_changes
|
|
468
|
+
- cloudwatch_log_metric_filter_sign_in_without_mfa
|
|
469
|
+
- cloudwatch_log_metric_filter_unauthorized_api_calls
|
|
470
|
+
- config_recorder_all_regions_enabled
|
|
471
|
+
- guardduty_is_enabled
|
|
472
|
+
- rds_instance_enhanced_monitoring_enabled
|
|
473
|
+
- id: T1498
|
|
474
|
+
title: Adversaries may perform Network Denial of Service (DoS) attacks to degrade
|
|
475
|
+
or block the availability of targeted resources to users. Network DoS can be performed
|
|
476
|
+
by exhausting the network bandwidth services rely on. Example resources include
|
|
477
|
+
specific websites, email services, DNS, and web-based app…
|
|
478
|
+
checks:
|
|
479
|
+
- config_recorder_all_regions_enabled
|
|
480
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
481
|
+
- ec2_networkacl_allow_ingress_tcp_port_22
|
|
482
|
+
- ec2_networkacl_allow_ingress_tcp_port_3389
|
|
483
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_all_ports
|
|
484
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
485
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
|
|
486
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888
|
|
487
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601
|
|
488
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21
|
|
489
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
|
|
490
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
|
|
491
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
|
|
492
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
|
|
493
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483
|
|
494
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
|
|
495
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
|
|
496
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434
|
|
497
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23
|
|
498
|
+
- guardduty_is_enabled
|
|
499
|
+
- networkfirewall_in_all_vpc
|
|
500
|
+
- shield_advanced_protection_in_associated_elastic_ips
|
|
501
|
+
- shield_advanced_protection_in_classic_load_balancers
|
|
502
|
+
- shield_advanced_protection_in_cloudfront_distributions
|
|
503
|
+
- shield_advanced_protection_in_global_accelerators
|
|
504
|
+
- shield_advanced_protection_in_internet_facing_load_balancers
|
|
505
|
+
- shield_advanced_protection_in_route53_hosted_zones
|
|
506
|
+
- id: T1087
|
|
507
|
+
title: Adversaries may attempt to get a listing of valid accounts, usernames, or
|
|
508
|
+
email addresses on a system or within a compromised environment. This information
|
|
509
|
+
can help adversaries determine which accounts exist, which can aid in follow-on
|
|
510
|
+
behavior such as brute-forcing, spear-phishing attacks, or acco…
|
|
511
|
+
checks:
|
|
512
|
+
- organizations_account_part_of_organizations
|
|
513
|
+
- id: T1580
|
|
514
|
+
title: An adversary may attempt to discover infrastructure and resources that are
|
|
515
|
+
available within an infrastructure-as-a-service (IaaS) environment. This includes
|
|
516
|
+
compute service resources such as instances, virtual machines, and snapshots as
|
|
517
|
+
well as resources of other services including the storage and …
|
|
518
|
+
checks:
|
|
519
|
+
- guardduty_is_enabled
|
|
520
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
521
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
522
|
+
- iam_inline_policy_no_administrative_privileges
|
|
523
|
+
- iam_no_custom_policy_permissive_role_assumption
|
|
524
|
+
- iam_policy_allows_privilege_escalation
|
|
525
|
+
- iam_policy_no_full_access_to_cloudtrail
|
|
526
|
+
- iam_policy_no_full_access_to_kms
|
|
527
|
+
- organizations_account_part_of_organizations
|
|
528
|
+
- securityhub_enabled
|
|
529
|
+
- id: T1538
|
|
530
|
+
title: An adversary may use a cloud service dashboard GUI with stolen credentials
|
|
531
|
+
to gain useful information from an operational cloud environment, such as specific
|
|
532
|
+
services, resources, and features. For example, the GCP Command Center can be
|
|
533
|
+
used to view all assets, findings of potential security risks, …
|
|
534
|
+
checks:
|
|
535
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
536
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
537
|
+
- iam_inline_policy_no_administrative_privileges
|
|
538
|
+
- iam_user_mfa_enabled_console_access
|
|
539
|
+
- organizations_account_part_of_organizations
|
|
540
|
+
- id: T1526
|
|
541
|
+
title: An adversary may attempt to enumerate the cloud services running on a system
|
|
542
|
+
after gaining access. These methods can differ from platform-as-a-service (PaaS),
|
|
543
|
+
to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services
|
|
544
|
+
exist throughout the various cloud providers and can i…
|
|
545
|
+
checks:
|
|
546
|
+
- guardduty_is_enabled
|
|
547
|
+
- id: T1619
|
|
548
|
+
title: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries
|
|
549
|
+
may use this information during automated discovery to shape follow-on behaviors,
|
|
550
|
+
including requesting all or specific objects from cloud storage. Similar to File
|
|
551
|
+
and Directory Discovery on a local host, after identifyin…
|
|
552
|
+
checks:
|
|
553
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
554
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
555
|
+
- iam_inline_policy_no_administrative_privileges
|
|
556
|
+
- iam_policy_allows_privilege_escalation
|
|
557
|
+
- id: T1046
|
|
558
|
+
title: Adversaries may attempt to get a listing of services running on remote hosts
|
|
559
|
+
and local network infrastructure devices, including those that may be vulnerable
|
|
560
|
+
to remote software exploitation. Common methods to acquire this information include
|
|
561
|
+
port and/or vulnerability scans using tools that are brou…
|
|
562
|
+
checks:
|
|
563
|
+
- ec2_confidential_workload_host_unrestricted_ingress
|
|
564
|
+
- ec2_networkacl_allow_ingress_any_port
|
|
565
|
+
- ec2_networkacl_allow_ingress_tcp_port_22
|
|
566
|
+
- ec2_networkacl_allow_ingress_tcp_port_3389
|
|
567
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_all_ports
|
|
568
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
|
|
569
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389
|
|
570
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888
|
|
571
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601
|
|
572
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21
|
|
573
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092
|
|
574
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211
|
|
575
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mongodb_27017_27018
|
|
576
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306
|
|
577
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483
|
|
578
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432
|
|
579
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379
|
|
580
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434
|
|
581
|
+
- ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23
|
|
582
|
+
- elbv2_waf_acl_attached
|
|
583
|
+
- guardduty_is_enabled
|
|
584
|
+
- inspector2_active_findings_exist
|
|
585
|
+
- inspector2_is_enabled
|
|
586
|
+
- networkfirewall_in_all_vpc
|
|
587
|
+
- id: T1201
|
|
588
|
+
title: Adversaries may attempt to access detailed information about the password
|
|
589
|
+
policy used within an enterprise network or cloud environment. Password policies
|
|
590
|
+
are a way to enforce complex passwords that are difficult to guess or crack through
|
|
591
|
+
Brute Force. This information may help the adversary to crea…
|
|
592
|
+
checks:
|
|
593
|
+
- iam_aws_attached_policy_no_administrative_privileges
|
|
594
|
+
- iam_customer_attached_policy_no_administrative_privileges
|
|
595
|
+
- iam_inline_policy_no_administrative_privileges
|
|
596
|
+
- iam_policy_allows_privilege_escalation
|