Threat video1:00
AWS Login Phishing Relays Device Codes: Detection & IOCs
Mitiga's PoC has attackers relay a victim's AWS sign-in code into their own CLI session. Includes 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for AWS Login Phishing Relays Device Codes: Detection & IOCs →
Chapters
- 0:00The hookResearchers showed the lure works.
- 0:04The storyAWS added browser login for developers.
- 0:11Attack pathResearchers built a PoC kit.
- 0:25AttributionNo threat actor: this was defensive research.
- 0:29Indicators of compromise8 indicators to hunt: 2 domains and 6 strings.
- 0:35MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to collection.
- 0:40Remediation3 steps now: Hunt CloudTrail for requestParameters.client_id = arn:aws:signin:::devtools/cross-device.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Researchers showed the lure works.
0:05AWS added browser login for developers.
0:08Mitiga published the findings.
0:11Researchers built a PoC kit.
0:14A login waits, then a lookalike notice.
0:16The user completes MFA, returns the code.
0:19The CLI receives a session token.
0:25No threat actor: this was defensive research.
0:308 indicators to hunt: 2 domains and 6 strings.
0:3513 ATT&CK techniques, from resource development to collection.
0:403 steps now: Hunt CloudTrail for requestParameters.client_id = arn:aws:signin:::devtools/cross-device.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.