CLOUD DFIR - AWS IAM PRIVESC LEADS TO EC2 RANSOMWARE

Summary from the TLDR InfoSec newsletter

This post examines the AWS DFIR process in a fictional scenario where an organization suffered a ransomware attack that encrypted all files on all of its EC2 instances. The analyst first investigated Sysmon logs on a Windows EC2 instance and identified that the AWS SSM Run Command was used to download malicious scripts from a GitHub repo which were then executed as SYSTEM. They then analyzed CloudTrail logs to identify the role that was used to run the SSM commands, but since it was a commonly used role to execute SSM Commands, the analyst also needed to track down the user that assumed the role in the given timeframe. Upon identifying the compromised user, the analyst also identified that the attacker moved laterally from the initially compromised account by creating access keys for the account that had permissions to assume the SSM commands role.