Mapping AWS Events to MITRE ATT&CK
Akira Nishikawa, a security engineer and developer behind the open-source tools Suzaku and Senrigan, presented at HITCON 2026 on detecting threats within AWS environments. His work, conducted as part of the volunteer-run security community Yamato Security, focuses on correlating AWS CloudTrail events with the stages defined by the MITRE ATT&CK framework. This approach provides a structured way to understand and identify malicious activities occurring in cloud infrastructure.
The MITRE ATT&CK framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. By mapping AWS security events to these tactics, organizations can gain a clearer picture of potential attack vectors and develop more effective detection and response strategies. CloudTrail, AWS's service for logging, monitoring, and retaining account activity, generates a wealth of data that can be analyzed against the ATT&CK matrix.
Yamato Security's presentation aimed to bridge the gap between cloud-specific security monitoring and established threat intelligence frameworks. The tools Suzaku and Senrigan are designed to ingest and process these AWS logs, making it easier to identify patterns indicative of ATT&CK techniques.
Reconnaissance and Initial Access in AWS
The Reconnaissance tactic in ATT&CK involves adversaries gathering information to plan future operations. In an AWS context, this can manifest as attackers querying metadata services, enumerating S3 buckets for public access, or attempting to discover exposed API endpoints. CloudTrail logs can capture API calls related to these activities, such as Describe* calls for various AWS resources, List* calls for services like S3, or attempts to access instance metadata endpoints.
Initial Access is the stage where adversaries first gain a foothold in the environment. For AWS, common initial access vectors include compromised credentials (obtained through phishing, credential stuffing, or key leakage), exploitation of vulnerable applications hosted on EC2 instances, or misconfigured access controls. CloudTrail events that signal potential initial access might include unusual ConsoleLogin events, API calls from unexpected IP addresses or geographic locations, or the creation of new IAM users or roles with excessive permissions.
The surprising detail here is how often seemingly innocuous API calls, like listing S3 buckets, can be precursors to more significant breaches. Without proper context and correlation, these early indicators can be easily overlooked.
Execution and Persistence in the Cloud
The Execution tactic refers to adversaries running malicious code on a compromised system. In AWS, this could involve deploying malicious code onto EC2 instances, leveraging Lambda functions for execution, or exploiting containerized environments. CloudTrail logs can record API calls related to code deployment, such as RunInstances for EC2, CreateFunction for Lambda, or container orchestration commands. Additionally, monitoring agent logs on EC2 instances for unexpected process execution is crucial.
Persistence is achieved when adversaries maintain their foothold over time, even after reboots or credential changes. In AWS, this can be done by creating new IAM users or roles with persistent access, modifying existing policies to grant broader permissions, establishing new persistent compute resources (like EC2 instances or Lambda functions), or setting up scheduled tasks (e.g., via CloudWatch Events or EventBridge) to re-execute malicious code. CloudTrail events that indicate persistence might include the creation or modification of IAM entities, changes to security group rules, or the establishment of new persistent resources that deviate from normal operational patterns.
Privilege Escalation and Defense Evasion
Privilege Escalation involves adversaries gaining higher-level permissions within the environment. In AWS, this is often achieved by exploiting misconfigurations in IAM policies, leveraging vulnerabilities in services or applications, or compromising more privileged credentials. Examples include exploiting overly permissive roles attached to EC2 instances or Lambda functions, or finding ways to assume roles that grant administrative access. CloudTrail logs can show modifications to IAM policies, the assumption of new roles, or API calls that succeed with elevated privileges that were previously denied.
Defense Evasion tactics are used by adversaries to avoid detection. This can include disabling logging services (though AWS makes this difficult for CloudTrail itself), altering security configurations, using legitimate tools for malicious purposes (Living Off the Land), or obfuscating their activities. In AWS, attempts to disable CloudTrail logging (via StopLogging or deletion of trails), modifying security groups to allow unexpected inbound traffic, or creating resources that blend in with legitimate infrastructure can all be indicators. The use of specific AWS API actions to manipulate security settings or hide resources falls under this tactic.
Credential Access and Discovery
The Credential Access tactic focuses on adversaries stealing account names and passwords. In AWS, this includes stealing IAM access keys and secret keys, harvesting credentials from EC2 instance metadata services, or obtaining credentials from compromised applications or configuration files. CloudTrail can log API calls related to the creation or retrieval of access keys (CreateAccessKey`, `ListAccessKeys`, `GetAccessKeyLastUsed`) and suspicious attempts to access sensitive configuration data. Monitoring for key rotation or unexpected key usage is vital.
Discovery involves adversaries learning about the environment to identify targets and plan lateral movement. This includes mapping network configurations, enumerating users and groups, identifying valuable data stores (like S3 buckets), and understanding system configurations. AWS API calls like Describe* and List* for various services (VPCs, EC2 instances, IAM users, S3 buckets, RDS databases) are common discovery techniques. Analyzing the frequency and source of these calls can reveal reconnaissance efforts.
Lateral Movement and Exfiltration
Lateral Movement is the process by which adversaries move from one compromised system to another within the environment. In AWS, this could involve using compromised credentials to access other accounts, assuming roles to gain access to different services or resources, or exploiting network trust relationships. If an EC2 instance is compromised, an attacker might use its credentials to access an S3 bucket or interact with other AWS services. CloudTrail events showing API calls originating from a compromised resource to other services or accounts are key indicators.
Finally, Exfiltration is the act of adversaries stealing data. This can range from small amounts of sensitive configuration data to large datasets from databases or storage services. In AWS, this might involve copying data from S3 buckets to external locations, transferring data from RDS instances, or using services like CloudFront or API Gateway to exfiltrate data disguised as normal traffic. Monitoring large data transfer operations, unusual network egress patterns, and suspicious API calls to services like S3 (GetObject followed by external transmission) are critical for detecting exfiltration.
The Yamato Security project provides a valuable framework for security professionals to translate cloud-native events into actionable threat intelligence, enhancing the effectiveness of detection and response in AWS environments.