🔷 Abusing Azure Hybrid Workers for Privilege Escalation - Part 1

Azure Hybrid Workers can be configured to use Automation Account "Run as" accounts, which can expose the credentials to anyone with local administrator access to the Hybrid Worker. Since "Run as" accounts are typically subscription contributors, this can lead to privilege escalation from multiple Azure Role-Based Access Control (RBAC) roles.

https://www.netspi.com/blog/technical/cloud-penetration-testing/abusing-azure-hybrid-workers-for-privilege-escalation

#azure

🔶 aws | ClickOops

A simple Lambda that monitors your CloudTrail log files to find manual actions taken in your accounts.

https://medium.com/cloudandthings/aws-clickoops-1b8cabc9b8e3

#aws

🔷 A goat in the boat: a look at how Defender for Containers protects your clusters

Article exploring and testing Defender for Containers against a vulnerable environment and see what it can detect or prevent.

https://guillaumeben.xyz/defender-containers.html

#azure

🔶 Fantastic AWS Hacks and Where to Find Them

Getting started in AWS security, and how companies are getting hacked on AWS. You can also check a nice interactive mindmap.

https://docs.google.com/presentation/d/1WIg9Zctp7emuEgnehArUEwvkHSpC6JOi7ojejMX6L_s/edit#slide=id.g118f683adf8_0_43

#aws

🔴 Google Cloud Storage Explorer: Enumerating Google Cloud’s Bucket Access Permissions

The 'Google Cloud Platform Storage Explorer' tool crawls all of your Google Cloud projects and detects which have access to all storage data.

https://orca.security/resources/blog/google-cloud-platform-storage-explorer

#gcp

🔷 Azure Dominance Paths

A comprehensive map of Azure and Azure AD attack paths.

https://cloudbrothers.info/en/azure-dominance-paths

#azure

🔶🔷🔴 What to look for when reviewing a company's infrastructure

A comprehensive guide that provides a structured approach to reviewing the security architecture of a multi-cloud SaaS company and finding its most critical components.

https://www.marcolancini.it/2022/blog-cloud-security-infrastructure-review

#aws #azure #gcp

🔶 Automated Incident Response and Forensics Framework

A framework which aims to facilitate automated steps for incident response and forensics based on the AWS Incident Response White Paper.

https://github.com/awslabs/aws-automated-incident-response-and-forensics

#aws

🔷 Cloudy with a Chance of Unclear Mailbox Sync: CrowdStrike Services Identifies Logging Inconsistencies in Microsoft 365

Multiple investigations and testing by the CrowdStrike Services team identified inconsistencies in Azure AD sign-in logs.

https://www.crowdstrike.com/blog/crowdstrike-services-identifies-logging-inconsistencies-in-microsoft-365 (use VPN if you are from Russia)

#azure

🔴 New Privilege Escalation Techniques that Might Compromise Your Google Cloud Platform

Some common attack techniques that an attacker can use to exploit your Google Cloud Platform (GCP) environment, gain permissions, and steal information via services like Dataproc, Dataflow, and Composer.

https://medium.com/xm-cyber/new-privilege-escalation-techniques-are-compromising-your-google-cloud-platform-3b0ca78e6b6b

#gcp

🔶 Access Undenied on AWS

Ermetic’s Noam Dahan describes a cool new tool, Access Undenied, which parses AWS AccessDenied CloudTrail events, explains the reasons for them, and offers actionable least privilege fixes. See Noam’s fwd:cloudsec talk on it here and Twitter thread here.

https://ermetic.com/blog/aws/access-undenied-on-aws

#aws

🔶 Codify your best practices using service control policies

Overview post on what SCPs are, why you should create SCPs, and the strategy you can use to implement SCPs, as well as how to continue iterating and improving SCPs as your workloads and business needs change. Part 2 discusses how you can create SCPs using constructs from AWS Well-Architected.

https://aws.amazon.com/ru/blogs/mt/codify-your-best-practices-using-service-control-policies-part-1

#aws

🔶🔷🔴 The Expansion of Malware to the Cloud

Overview of key threats for cloud environments, with a focus on Linux malware, database malware, malicious cryptomining code, and ransomware

https://orca.security/resources/blog/cloud-linux-database-ransomware-cryptomining-malware

#aws #azure #gcp

🔷 Azure Active Directory Exposes Internal Information

The first issue allows anyone to query the directory synchronization status. The second issue could reveal internal information about the target Azure AD tenant, including the technical contact's full name and phone number.

https://www.secureworks.com/research/azure-active-directory-exposes-internal-information

#azure

🔶 Denonia: The First Malware Specifically Targeting Lambda

The malware uses newer address resolution techniques for command and control traffic to evade typical detection measures and virtual network access controls.

https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda

#aws

🔶 Incident report: From CLI to console, chasing an attacker in AWS

How the Expel team detected and stopped an unauthorized access in one AWS environment.

https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws

#aws

🔶 AWS Lambda: function URL is live!

AWS has announced AWS Lambda Function URLs, which basically lets you use Lambdas as a public HTTPS endpoint without using an API Gateway or Application Load Balancer. Lumigo’s Yan Cui provides more context about what Function URLs are, how they work, and how to take advantage of them.

https://lumigo.io/blog/aws-lambda-function-url-is-live

#aws

🔴 Best practices for secure data warehouse in Google Cloud

Introducing a new security blueprint that helps enterprises build a secure data warehouse.

https://cloud.google.com/blog/products/identity-security/best-practices-for-secure-data-warehouse-in-google-cloud

#gcp

🔶 CVE-2022-25165: Privilege Escalation to SYSTEM in AWS VPN Client

The AWS VPN Client application is affected by an arbitrary file write as SYSTEM, which can lead to privilege escalation.

https://rhinosecuritylabs.com/aws/cve-2022-25165-aws-vpn-client

#aws

🔷 Abusing Azure Hybrid Workers for Privilege Escalation - Part 2: An Azure PrivSec Story

The NetSPI team recently discovered a set of issues that allows any Azure user with the Subscription Reader role to dump saved credentials and certificates from Automation Accounts. In cases where Run As accounts were used, this allowed for a Reader to Contributor privilege escalation path.

https://www.netspi.com/blog/technical/cloud-penetration-testing/abusing-azure-hybrid-workers-part-2

#azure

🔶 AWS RDS Vulnerability Leads to AWS Internal Service Credentials

Lightspin's Research Team obtained credentials to an internal AWS service by exploiting a local file read vulnerability on the RDS EC2 instance using the log_fdw extension.

https://blog.lightspin.io/aws-rds-critical-security-vulnerability

#aws