AWS detection coverage

← Back to main site

Home/ Targets/ AWS

☁️AWS detections

Clankerusecase tracks 113 detection use cases covering the AWS attack surface across 64 MITRE ATT&CK techniques.

Detections targeting AWS infrastructure — CloudTrail, IAM, S3, EC2, Lambda, KMS, GuardDuty.

Open Detection Library → View on the matrix

113Use cases

64Techniques

13Articles

5Kill-chain phases

Delivery (6)

AWS brute-force ConsoleLogin then AssumeRole Internal delivery · alerting DDCW AWS Console login without MFA + impossible travel Internal delivery · alerting DDCW Impossible travel observed for IAM user Internal delivery · alerting DDCW AWS root account activity (any action) Internal delivery · alerting DDCW AWS CloudTrail AccessDenied spike Internal delivery · alerting DD [LLM] WAV-disguised stager pull from TeamPCP loader 83.142.209.203:8080 Bespoke delivery · hunting DSΣPDDCS

Exploitation (3)

[WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW [LLM] BodySnatcher (CVE-2025-12420) — Hardcoded 'servicenowexternalagent' Token Observed in HTTP Traffic Bespoke exploit · alerting DSΣPDDCS [LLM] ServiceNow Virtual Agent Invocation of Hidden AIA-Agent Invoker AutoChat Topic (CVE-2025-12420) Bespoke exploit · alerting DSPDDCS

Installation (19)

AWS CloudTrail logging configuration modified Internal install · alerting DDCW AWS Config service modified or stopped Internal install · alerting DDCW AWS EC2 security group rules modified Internal install · alerting DDCW AWS GuardDuty detector disabled or deleted Internal install · alerting DDCW AWS IAM AdministratorAccess policy applied to a user Internal install · alerting DDCW AWS IAM policy created / updated / version changed Internal install · alerting DDCW AWS Lambda function code or configuration modified Internal install · alerting DDCW AWS S3 bucket policy modified Internal install · alerting DDCW AWS SecurityHub disabled Internal install · alerting DDCW AWS VPC Flow Log deleted Internal install · alerting DDCW AWS Bedrock model invocation logging disabled Internal install · alerting DD AWS CloudWatch rule deleted Internal install · alerting DD AWS Detective behaviour graph deleted Internal install · alerting DD AWS EBS default encryption disabled Internal install · alerting DD AWS EC2 key-pair created Internal install · alerting DD AWS GuardDuty findings publishing disabled Internal install · alerting DD AWS Network ACL modified Internal install · alerting DD AWS Route53 query logging disabled Internal install · alerting DD AWS S3 public-access-block removed Internal install · alerting DD

Command & Control (5)

[LLM] Egress to typosquatted C2 flipboxstudio.info (Laravel-Lang Composer SC) Bespoke c2 · alerting DSΣPDDCS [LLM] Trust Wallet Shai-Hulud C2 callback to metrics-trustwallet.com / 138.124.70.40 Bespoke c2 · alerting DSΣPDDCS [LLM] Outbound C2 callback to xygeni-action backdoor IP 91.214.78.178 from CI runner Bespoke c2 · hunting DSΣPDDCS [LLM] Glassworm stage-2/stage-3 C2 callback to 45.32.150.251 or 217.69.3.152 Bespoke c2 · hunting DSΣPDD [LLM] Exfiltration to kubernetes-el attacker webhook.site UUIDs (Pwn Request payload) Bespoke c2 · alerting DSΣPDD

Actions on Objectives (80)

AWS access key created (programmatic credential) Internal actions · alerting DDCW AWS ECS cluster deleted Internal actions · alerting DDCW AWS KMS key deleted or scheduled for deletion Internal actions · alerting DDCW AWS RDS DB cluster deleted Internal actions · alerting DDCW AWS S3 bucket ACL / policy made public Internal actions · alerting DDCW AWS EC2 AMI shared publicly Internal actions · alerting DD AWS EBS snapshot made public Internal actions · alerting DD AWS Organization leave initiated Internal actions · alerting DD AWS S3 anomalous bulk download (exfil) Internal actions · alerting DD AWS Secrets Manager retrieval by unfamiliar principal Internal actions · alerting DD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD ASL AWS IAM AccessDenied Discovery Events ESCU actions · hunting P ASL AWS IAM Assume Role Policy Brute Force ESCU actions · alerting P AWS AMI Attribute Modification for Exfiltration ESCU actions · alerting P AWS Bedrock Delete GuardRails ESCU actions · alerting P AWS Bedrock Delete Knowledge Base ESCU actions · alerting P AWS Bedrock Invoke Model Access Denied ESCU actions · alerting P AWS Console Login Failed During MFA Challenge ESCU actions · alerting P AWS Create Policy Version to allow all resources ESCU actions · alerting P AWS CreateAccessKey ESCU actions · hunting P AWS CreateLoginProfile ESCU actions · alerting P AWS Credential Access Failed Login ESCU actions · alerting P AWS Credential Access GetPasswordData ESCU actions · hunting P AWS Credential Access RDS Password reset ESCU actions · alerting P AWS Defense Evasion PutBucketLifecycle ESCU actions · hunting P AWS Detect Users creating keys with encrypt policy without MFA ESCU actions · alerting P AWS Detect Users with KMS keys performing encryption S3 ESCU actions · hunting P AWS Disable Bucket Versioning ESCU actions · hunting P AWS EC2 Snapshot Shared Externally ESCU actions · alerting P AWS ECR Container Scanning Findings High ESCU actions · alerting P AWS ECR Container Scanning Findings Low Informational Unknown ESCU actions · hunting P AWS ECR Container Scanning Findings Medium ESCU actions · hunting P AWS Exfiltration via Anomalous GetObject API Activity ESCU actions · hunting P AWS Exfiltration via Bucket Replication ESCU actions · alerting P AWS Exfiltration via EC2 Snapshot ESCU actions · alerting P AWS High Number Of Failed Authentications For User ESCU actions · hunting P AWS High Number Of Failed Authentications From Ip ESCU actions · hunting P AWS IAM AccessDenied Discovery Events ESCU actions · hunting P AWS IAM Assume Role Policy Brute Force ESCU actions · alerting P AWS Lambda UpdateFunctionCode ESCU actions · hunting P AWS Multiple Failed MFA Requests For User ESCU actions · hunting P AWS Multiple Users Failing To Authenticate From Ip ESCU actions · hunting P AWS Network Access Control List Created with All Open Ports ESCU actions · alerting P AWS Network Access Control List Deleted ESCU actions · hunting P AWS SAML Update identity provider ESCU actions · alerting P AWS Successful Console Authentication From Multiple IPs ESCU actions · hunting P AWS Successful Single-Factor Authentication ESCU actions · alerting P AWS Unusual Number of Failed Authentications From Ip ESCU actions · hunting P AWS UpdateLoginProfile ESCU actions · alerting P Detect AWS Console Login by New User ESCU actions · hunting P Detect AWS Console Login by User from New City ESCU actions · hunting P Detect AWS Console Login by User from New Country ESCU actions · hunting P Detect AWS Console Login by User from New Region ESCU actions · hunting P Detect New Open S3 buckets ESCU actions · alerting P Detect New Open S3 Buckets over AWS CLI ESCU actions · alerting P Detect Spike in S3 Bucket deletion ESCU actions · hunting P ASL AWS CreateAccessKey ESCU actions · hunting P AWS Cloud Provisioning From Previously Unseen City ESCU actions · hunting P AWS Cloud Provisioning From Previously Unseen Country ESCU actions · hunting P AWS Cloud Provisioning From Previously Unseen Region ESCU actions · hunting P aws detect attach to role policy ESCU actions · hunting P aws detect permanent key creation ESCU actions · hunting P aws detect role creation ESCU actions · hunting P aws detect sts assume role abuse ESCU actions · hunting P aws detect sts get session token abuse ESCU actions · hunting P AWS SAML Access by Provider User and Principal ESCU actions · hunting P Detect new API calls from user roles ESCU actions · hunting P Detect new user AWS Console Login ESCU actions · hunting P Detect Spike in AWS API Activity ESCU actions · hunting P Detect Spike in Security Group Activity ESCU actions · hunting P EC2 Instance Modified With Previously Unseen User ESCU actions · hunting P EC2 Instance Started With Previously Unseen User ESCU actions · hunting P [LLM] AWS S3 DeleteBucket on a replication / log-delivery destination (bucket-hijack precursor) Bespoke actions · hunting ΣPDDCW [LLM] AWS S3 bucket DeleteBucket then CreateBucket of the SAME name across accounts (hijack signature) Bespoke actions · alerting PDDCW [LLM] Lateral movement via aws ssm send-command or kubectl exec spawned by python/node Bespoke actions · alerting DSΣPDDCSCW [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] AWS SSM SendCommand Fan-out from EC2 Instance Role (TeamPCP Worm Propagation) Bespoke actions · hunting PDD [LLM] Reuse of CircleCI-exfiltrated secrets / stolen SSO session from breach attacker IPs Bespoke actions · hunting DSΣPDDCSCW [LLM] WAF-Role EC2 instance credentials used from external IP (instance credential exfiltration) Bespoke actions · alerting PDDCW [LLM] WAF-Role mass S3 bucket enumeration and object download Bespoke actions · alerting PDDCW

Recent articles citing AWS-targeted detections

high The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

high Why EDR and proxy won’t save you from supply chain malware

high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets

high What MDM can't protect on developer machines (and what to do about it)

high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised

high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity

high You Patched LiteLLM, But Do You Know Your AI Blast Radius?

high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning

high Glassworm Strikes Popular React Native Phone Number Packages

high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package

high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations

high Supply chain security incident at CircleCI: Rotate your secrets

high A technical analysis of the Capital One cloud misconfiguration breach