HIJACKING AMAZON EVENTBRIDGE FOR LAUNCHING CROSS-ACCOUNT ATTACKS

Summary from the TLDR InfoSec newsletter

Attackers exploit AWS EventBridge's cross-account features using six MITRE ATT&CK attack patterns: establishing persistent backdoors via check-in events, creating bidirectional command and control channels, conducting reconnaissance by capturing all events, exfiltrating data in small chunks disguised as telemetry, lateral movement exploiting trust relationships, and exploiting vulnerable Lambda functions for unintended AWS API calls. These bypass traditional controls and evade detection because EventBridge PutEvents API calls aren't logged in CloudTrail. Defenses include Service Control Policies, specific event patterns, input validation, and monitoring CloudWatch for unusual activities.