How to Use Cloud-Specific Atomic IOCs to Detect Threat Activity
Summary
Wiz explains how cloud defenders can use atomic indicators—such as image names, subscription IDs, user and credential names, user agents and IPs—with cloud inventories and logs to detect and investigate suspicious activity.
Key points
- Cloud investigations can use IAM metadata and control-plane API activity alongside traditional indicators such as IP addresses and malware hashes; IPs alone may be less useful when attackers use VPNs or dedicated addresses.
- Image names or digests and cloud subscription IDs can serve as indicators. The article cites TeamTNT images and AWS accounts attributed to a threat actor called DangerDev.
- IaC providers or modules, cloud usernames, credential names, SSH keys, and resource naming patterns can also provide indicators. Generic names may cause false positives, and usernames are not globally unique.
- Cloud logs can be monitored for known malicious user agents and IPs. The article cites S3 Browser and WinSCP user-agent strings and API activity from an IP linked by researchers to phishing activity.
- Threat actors may create users, credentials, or trust relationships for persistence or privilege. The article recommends monitoring these events and maintaining lists of trusted subscriptions, modules, and providers.
- The proposed workflow is to collect indicators from threat intelligence and public reporting, automate cloud inventory and log monitoring, build or update detection rules, and investigate alerts against relevant threat context.
Article Details
- Defense Focus
- Detect and investigate malicious activity in cloud environments by combining atomic threat indicators with cloud inventories and runtime logs.
- Detection Methods
- Compare container and VM image names or digests against known-malicious image lists; also flag images that are rarely or never used in the environment.
- Maintain trusted cloud-subscription lists and detect or block trust relationships with unknown subscriptions.
- Inventory cloud users, credentials, secrets, and infrastructure-as-code providers or modules; monitor creation events and match names or other metadata against known-bad indicators.
- Monitor cloud logs for known-bad user-agent strings, IP addresses, and activity involving attacker-controlled subscriptions.
- Use file hashes and YARA rules to identify malware, and monitor communications and processes for atomic indicators.
- Data Sources
- Cloud API and audit logs, including AWS CloudTrail
- Cloud flow logs
- Inventories of cloud identities, credentials, subscriptions, resources, and container or VM images
- User-agent strings and source IP addresses in cloud logs
- File hashes and process telemetry
- Rule Types
- Custom cloud detection rules matching threat-intelligence indicators
- Sigma rules
- YARA rules
- Platforms
- Public cloud environments
- Kubernetes environments
- Container and virtual-machine environments
- Defensive Actions
- Collect atomic indicators from threat-intelligence feeds and open-source reporting, and integrate feed updates with detection rules.
- Automate cloud-environment inventory reporting and cloud-log monitoring.
- Maintain trusted and known-bad subscription lists; block or require approval for trust relationships with unknown subscriptions.
- Maintain lists of known-malicious container and VM images and investigate unfamiliar images.
- Inventory cloud users, secrets, and credentials; monitor for creation of new accounts and credentials and triage matches carefully because names can produce false positives.
- Review event and resource details when an alert fires; initiate incident response when the alert is confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]209[.]127[.]249 | An unknown threat actor used this address for cloud API calls and was also observed hosting phishing pages and sending smishing messages. |
MITRE ATT&CK
T1021.004 · SSHThe article describes uploading SSH keys to compromised compute instances or inserting keys through cloud control-plane mechanisms.T1078 · Valid AccountsFBot can leave the original compromised account in place, allowing attackers to continue using that valid account.T1078.004 · Cloud AccountsAttackers used cloud accounts, including compromised accounts, to access target environments and assume roles.T1098 · Account ManipulationThe article describes hijacking cloud subscriptions and creating trust relationships that grant attacker-controlled principals administrative privileges in target subscriptions.T1136 · Create AccountFBot can create new AWS user accounts with administrative privileges in a compromised organization.T1136.003 · Cloud AccountThe article describes creating attacker-controlled cloud subscriptions and cloud keys for persistence; DangerDev used its AWS subscriptions to assume roles in target accounts.T1485 · Data DestructionBling Libra used S3 Browser and WinSCP to interact with target S3 buckets and delete data.T1552 · Unsecured CredentialsAttackers can obtain existing cloud keys for identities in a target subscription and use them to enumerate permissions.T1578 · Modify Cloud Compute InfrastructureAttacker-controlled infrastructure-as-code or modified Terraform state can change target cloud infrastructure, including introducing malicious providers.T1586.003 · Cloud AccountsThe article describes attackers obtaining cloud keys or initial access to a target cloud environment before using cloud toolkits.T1588.006 · VulnerabilitiesThe article describes attackers using IP addresses to remotely scan and exploit weaknesses in target systems.T1610 · Deploy ContainerTeamTNT and other actors used custom images containing malware to launch containers or VMs in compromised cloud environments.
People
Shelly RabanPresented research reporting that around 0.5% of public Terraform modules contain anomalous and potentially risky blocks.xssfoxDeveloped the proof-of-concept Terraform module ssm-password, which demonstrated exfiltration of sensitive information during infrastructure deployment.Zack AllenHis talk on behavioral and atomic indicators is cited in the discussion of cloud threat intelligence.
Threat Actors
Androxgh0stIts persistence module was reported to create privileged IAM users and administrator groups in compromised AWS accounts.Bling LibraUnit 42 observed this actor creating S3 buckets in target AWS environments using a recurring naming pattern.DangerDevInvictus identified this actor using AWS subscriptions under its control to assume roles in target subscriptions.GreenBotNamed among toolkits observed in use by threat actors abusing AWS Simple Email Service.LegionNamed among toolkits observed in use by threat actors abusing AWS Simple Email Service.ShinyHuntersThe article explicitly identifies ShinyHunters as an alias of Bling Libra.SilentBobAqua Security identified Docker images used by this actor to deploy malicious scanners.TeamTNTReportedly used custom Docker images containing pre-installed malware in cloud environments.
Vendors
Amazon Web ServicesTo illustrate why this is a problem, imagine a SOC analyst monitoring for alerts related to an AWS environment, when they observe a role being assumed from an external AWS account following an API call performed from anMicrosoftattackers and can sometimes even uniquely identify a malicious actor or tool. For example, in a recent Microsoft Azure account takeover campaign (T1078), Proofpoint researchers observed a user agent string,WizSimilarly, at Wiz we recently identified a Dero cryptojacking campaign in which the threat actor created custom docker images named nohuppo:pause, dockerproxys:pause, and dockerproxys:pauser (among others), containing
Products
AWSTo illustrate why this is a problem, imagine a SOC analyst monitoring for alerts related to an AWS environment, when they observe a role being assumed from an external AWS account following an API call performed from anAWS CloudFormationinfrastructure (networks, VMs, load balancers, etc.) using machine-readable scripts like Terraform, CloudFormation, or Ansible, allowing for automated and consistent deployment. However, when an organization deploysCloudTrailto interact with target S3 buckets, perform reconnaissance, and delete data (T1485). By analyzing AWS CloudTrail logs in victim environments, they were able to track the user-agent strings associated with theseDockerVMs in compromised environments (T1610). In TeamTNT’s case, Trend Micro observed the actor using custom Docker images called alpineos and sandeep078 containing rootkits, container escape exploits, cryptominers,KubernetesThe cloud introduces new types of external attack surface such as cloud service provider (CSP) and Kubernetes endpoints, as well as new modes of lateral movement such as IAM privilege escalation and SSM-facilitatedMicrosoft 365 Apps for Enterprise(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36, in use by the threat actor when connecting to Microsoft 365 applications in the target environment. Once identified, although not globally unique, monitoring forOpen Policy Agent (OPA)attackers can exploit Policy-as-Code engines—like those utilized in HashiCorp Sentinel or Open Policy Agent (OPA)—by altering policy code to leak sensitive credentials; attackers can inject code that exfiltratesTerraformmanagement of infrastructure (networks, VMs, load balancers, etc.) using machine-readable scripts like Terraform, CloudFormation, or Ansible, allowing for automated and consistent deployment. However, when anWiz Cloud Detection and Response (CDR)Wiz CDR alerts you to API calls or connections (logged in flow logs or cloud logs) that originated in malicious IP addresses or using known bad user agents. Wiz SensorWiz Sensor allows you to continuously monitor for any incoming or outgoing communication between compute instances and malicious IP addresses and domains, and also alerts you to processes matching various atomic IOCs.
Tools
AndroxGh0stSimilarly, toolkits like AndroxGh0st, Legion, and GreenBot, which have been observed in use by threat actors abusing AWS Simple Email Service (SES), also include uniquely identifiable hardcoded usernames. According toCloudGrapplerTo facilitate this, you can use cloud native tools, commercial solutions like Wiz, or various open-source tools such as Sigma or CloudGrappler.FBotAn example can be found in FBot, a Python-based hacking tool. FBot's feature to create a new AWS user account with administrative privileges (T1136), without removing the original compromised account (T1078), enablesGreenBotSimilarly, toolkits like AndroxGh0st, Legion, and GreenBot, which have been observed in use by threat actors abusing AWS Simple Email Service (SES), also include uniquely identifiable hardcoded usernames. According toLegionSimilarly, toolkits like AndroxGh0st, Legion, and GreenBot, which have been observed in use by threat actors abusing AWS Simple Email Service (SES), also include uniquely identifiable hardcoded usernames. According toS3 Browserinvolving Bling Libra, Unit 42 investigators found that the attackers used specific tools such as S3 Browser and WinSCP to interact with target S3 buckets, perform reconnaissance, and delete data (T1485). BySigmaTo facilitate this, you can use cloud native tools, commercial solutions like Wiz, or various open-source tools such as Sigma or CloudGrappler.WinSCPBling Libra, Unit 42 investigators found that the attackers used specific tools such as S3 Browser and WinSCP to interact with target S3 buckets, perform reconnaissance, and delete data (T1485). By analyzing AWSYARAWiz leverages file hashes and YARA rules to detect malware via our agentless malware scanner.