Cloudtrail SecretsManager secret retrieved from AWS CloudShell environment

cloudtrail

Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1555-credentials-from-password-stores

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when an AWS secret is retrieved from an AWS CloudShell environment.

Strategy

Monitor CloudTrail and detect when an AWS secret is retrieved from an AWS CloudShell environment. The threat group LUCR-3 uses AWS CloudShell in the AWS management console to carry out activities that require direct interaction with the AWS API, such as the retrieval of secrets.

Triage and response

  1. Determine if {{@userIdentity.arn}} should have carried out this operation.
  2. If the API calls were not made by the user:
  • Rotate user credentials.
  • Rotate the secrets retrieved by the identity, if feasible.
  • Determine what other API calls were made by the user.
  • Begin your organization’s incident response process and investigate.