Skip to content

Commit 2930c09

Browse files
authored
Map Stratus Attack Techniques to the AWS Threat Catalogue (#691)
* Add possibility to map attack techniques to arbitrary frameworks * Map AWS attack techniques to the Threat Techniques Catalog for AWS
1 parent 508060e commit 2930c09

File tree

95 files changed

+838
-191
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

95 files changed

+838
-191
lines changed

docs/attack-techniques/AWS/aws.credential-access.ec2-get-password-data.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ title: Retrieve EC2 Password Data
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
13+
14+
- MITRE ATT&CK
15+
- Credential Access
1316

1417

15-
- Credential Access
1618

1719
## Description
1820

docs/attack-techniques/AWS/aws.credential-access.ec2-steal-instance-credentials.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,17 @@ title: Steal EC2 Instance Credentials
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
1313

14+
- MITRE ATT&CK
15+
- Credential Access
16+
17+
18+
- Threat Technique Catalog for AWS:
19+
20+
- [Unsecured Credentials: Cloud Instance Metadata API](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1552.005.html) (T1552.005)
21+
1422

15-
- Credential Access
1623

1724
## Description
1825

docs/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ title: Retrieve a High Number of Secrets Manager secrets (Batch)
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
13+
14+
- MITRE ATT&CK
15+
- Credential Access
1316

1417

15-
- Credential Access
1618

1719
## Description
1820

docs/attack-techniques/AWS/aws.credential-access.secretsmanager-retrieve-secrets.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ title: Retrieve a High Number of Secrets Manager secrets
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
13+
14+
- MITRE ATT&CK
15+
- Credential Access
1316

1417

15-
- Credential Access
1618

1719
## Description
1820

docs/attack-techniques/AWS/aws.credential-access.ssm-retrieve-securestring-parameters.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ title: Retrieve And Decrypt SSM Parameters
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
13+
14+
- MITRE ATT&CK
15+
- Credential Access
1316

1417

15-
- Credential Access
1618

1719
## Description
1820

docs/attack-techniques/AWS/aws.defense-evasion.cloudtrail-delete.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,17 @@ title: Delete CloudTrail Trail
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
1313

14+
- MITRE ATT&CK
15+
- Defense Evasion
16+
17+
18+
- Threat Technique Catalog for AWS:
19+
20+
- [Impair Defenses: Disable Cloud Logs](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1562.008.html) (T1562.008)
21+
1422

15-
- Defense Evasion
1623

1724
## Description
1825

docs/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,17 @@ title: Disable CloudTrail Logging Through Event Selectors
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
1313

14+
- MITRE ATT&CK
15+
- Defense Evasion
16+
17+
18+
- Threat Technique Catalog for AWS:
19+
20+
- [Impair Defenses: Disable Cloud Logs](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1562.008.html) (T1562.008)
21+
1422

15-
- Defense Evasion
1623

1724
## Description
1825

docs/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,17 @@ title: CloudTrail Logs Impairment Through S3 Lifecycle Rule
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
1313

14+
- MITRE ATT&CK
15+
- Defense Evasion
16+
17+
18+
- Threat Technique Catalog for AWS:
19+
20+
- [Impair Defenses: Disable Cloud Logs](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1562.008.html) (T1562.008)
21+
1422

15-
- Defense Evasion
1623

1724
## Description
1825

docs/attack-techniques/AWS/aws.defense-evasion.cloudtrail-stop.md

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,17 @@ title: Stop CloudTrail Trail
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
1313

14+
- MITRE ATT&CK
15+
- Defense Evasion
16+
17+
18+
- Threat Technique Catalog for AWS:
19+
20+
- [Impair Defenses: Disable Cloud Logs](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1562.008.html) (T1562.008)
21+
1422

15-
- Defense Evasion
1623

1724
## Description
1825

docs/attack-techniques/AWS/aws.defense-evasion.dns-delete-logs.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ title: Delete DNS query logs
99

1010
Platform: AWS
1111

12-
## MITRE ATT&CK Tactics
12+
## Mappings
13+
14+
- MITRE ATT&CK
15+
- Defense Evasion
1316

1417

15-
- Defense Evasion
1618

1719
## Description
1820

0 commit comments

Comments
 (0)