Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating technique references for Unit42 VM Attack Path article. #539

Merged
merged 1 commit into from
Jul 2, 2024
Merged

Updating technique references for Unit42 VM Attack Path article. #539

merged 1 commit into from
Jul 2, 2024

Conversation

siigil
Copy link
Contributor

@siigil siigil commented Jul 2, 2024

What does this PR do?

Adds references to https://unit42.paloaltonetworks.com/cloud-virtual-machine-attack-vectors/ for applicable techniques mentioned in this writeup:

Cloud Writeup Technique Writeup Name Stratus Technique
AWS Direct Code Execution Use SSM Run Command to Execute Code /AWS/aws.execution.ssm-send-command.md
AWS SSH Key Push Use EC2 Instance Connect to Push SSH Keys /AWS/aws.lateral-movement.ec2-instance-connect.md
AWS Startup Script Manipulation Modify Startup Scripts in User Data /AWS/aws.execution.ec2-user-data.md
AWS SSH Over Middleware Use SSM Session Manager to Log into a VM /AWS/aws.execution.ssm-start-session.md
Azure Direct Code Execution Use Virtual Machine Run Command to Execute Code /azure/azure.execution.vm-run-command.md
Azure Direct Code Execution Use a Custom Script Extension to Run Scripts /azure/azure.execution.vm-custom-script-extension.md

Motivation

Adding references to Unit42 VM techniques article in support of #527.

Checklist

N/A as documentation update.

  • The attack technique emulates a single attack step, not a full attack chain
  • We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
  • The attack technique makes no assumption about the state of the environment prior to warming it up

@christophetd christophetd merged commit cea6917 into DataDog:main Jul 2, 2024
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants