Threat video1:00
NotC2 Bedrock C2 over SQS and Lambda: Detection & IOCs
NotC2 chains Bedrock, SQS and Lambda into a natural-language C2 channel. The free Splunk SPL rule leads 9 detection rules and 7 IOCs for it.
Read the full threat intel for NotC2 Bedrock C2 over SQS and Lambda: Detection & IOCs →
Chapters
- 0:00The hookResearchers built a command channel from AWS services.
- 0:05The storyVaronis published a proof of concept.
- 0:11Attack pathVaronis built it on credentials already held.
- 0:28AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from execution to command and control.
- 0:43Remediation4 steps now: Alert on SNS Subscribe calls made by Lambda execution roles.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Researchers built a command channel from AWS services.
0:05Varonis published a proof of concept.
0:07It chains four native AWS services.
0:12Varonis built it on credentials already held.
0:15Enumeration can find a reusable role.
0:18A queue and function get deployed.
0:20A prompt reaches SQS.
0:22Bedrock turns it into calls; SNS returns results.
0:28No threat actor: this was defensive research.
0:33No malicious indicators were published.
0:387 ATT&CK techniques, from execution to command and control.
0:434 steps now: Alert on SNS Subscribe calls made by Lambda execution roles.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.