Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Updating technique references for Unit42 VM Attack Path article. #539

Merged
merged 1 commit into from
Jul 2, 2024
Merged

Updating technique references for Unit42 VM Attack Path article. #539

merged 1 commit into from
Jul 2, 2024

Conversation

siigil
Copy link
Contributor

@siigil siigil commented Jul 2, 2024

What does this PR do?

Adds references to https://unit42.paloaltonetworks.com/cloud-virtual-machine-attack-vectors/ for applicable techniques mentioned in this writeup:

Cloud Writeup Technique Writeup Name Stratus Technique
AWS Direct Code Execution Use SSM Run Command to Execute Code /AWS/aws.execution.ssm-send-command.md
AWS SSH Key Push Use EC2 Instance Connect to Push SSH Keys /AWS/aws.lateral-movement.ec2-instance-connect.md
AWS Startup Script Manipulation Modify Startup Scripts in User Data /AWS/aws.execution.ec2-user-data.md
AWS SSH Over Middleware Use SSM Session Manager to Log into a VM /AWS/aws.execution.ssm-start-session.md
Azure Direct Code Execution Use Virtual Machine Run Command to Execute Code /azure/azure.execution.vm-run-command.md
Azure Direct Code Execution Use a Custom Script Extension to Run Scripts /azure/azure.execution.vm-custom-script-extension.md

Motivation

Adding references to Unit42 VM techniques article in support of #527.

Checklist

N/A as documentation update.

  • The attack technique emulates a single attack step, not a full attack chain
  • We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
  • The attack technique makes no assumption about the state of the environment prior to warming it up

@christophetd christophetd merged commit cea6917 into DataDog:main Jul 2, 2024
5 checks passed
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants