-
Notifications
You must be signed in to change notification settings - Fork 219
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com> Co-authored-by: rileydakota <DAKOTARILEY2@GMAIL.COM>
- Loading branch information
1 parent
5f1f8a1
commit 7ed4953
Showing
22 changed files
with
1,015 additions
and
9 deletions.
There are no files selected for viewing
48 changes: 48 additions & 0 deletions
48
docs/attack-techniques/GCP/gcp.persistence.create-admin-service-account.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| --- | ||
| title: Create an Admin GCP Service Account | ||
| --- | ||
|
|
||
| # Create an Admin GCP Service Account | ||
|
|
||
|
|
||
|
|
||
|
|
||
| Platform: GCP | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Persistence | ||
| - Privilege Escalation | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Establishes persistence by creating a new service account and assigning it | ||
| <code>owner</code> permissions inside the current GCP project. | ||
|
|
||
| <span style="font-variant: small-caps;">Warm-up</span>: None | ||
|
|
||
| <span style="font-variant: small-caps;">Detonation</span>: | ||
|
|
||
| - Create a service account | ||
| - Update the current GCP project's IAM policy to bind the service account to the <code>owner</code> role' | ||
|
|
||
| References: | ||
| - https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-cloud-platform/ | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate gcp.persistence.create-admin-service-account | ||
| ``` | ||
| ## Detection | ||
|
|
||
|
|
||
| Using the following GCP Admin Activity audit logs events: | ||
|
|
||
| - <code>google.iam.admin.v1.CreateServiceAccount</code> | ||
| - <code>SetIamPolicy</code> with <code>resource.type=project</code> | ||
|
|
||
|
|
47 changes: 47 additions & 0 deletions
47
docs/attack-techniques/GCP/gcp.persistence.create-service-account-key.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| --- | ||
| title: Create a GCP Service Account Key | ||
| --- | ||
|
|
||
| # Create a GCP Service Account Key | ||
|
|
||
|
|
||
|
|
||
|
|
||
| Platform: GCP | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Persistence | ||
| - Privilege Escalation | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Establishes persistence by creating a service account key on an existing service account. | ||
|
|
||
| <span style="font-variant: small-caps;">Warm-up</span>: | ||
|
|
||
| - Create a service account | ||
|
|
||
| <span style="font-variant: small-caps;">Detonation</span>: | ||
|
|
||
| - Create a new key for the service account | ||
|
|
||
| References: | ||
|
|
||
| - https://expel.com/blog/incident-report-spotting-an-attacker-in-gcp/ | ||
| - https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/ | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate gcp.persistence.create-service-account-key | ||
| ``` | ||
| ## Detection | ||
|
|
||
|
|
||
| Using GCP Admin Activity audit logs event <code>google.iam.admin.v1.CreateServiceAccountKey</code>. | ||
|
|
||
|
|
155 changes: 155 additions & 0 deletions
155
.../attack-techniques/GCP/gcp.privilege-escalation.impersonate-service-accounts.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,155 @@ | ||
| --- | ||
| title: Impersonate GCP Service Accounts | ||
| --- | ||
|
|
||
| # Impersonate GCP Service Accounts | ||
|
|
||
|
|
||
| <span class="smallcaps w3-badge w3-blue w3-round w3-text-white" title="This attack technique can be detonated multiple times">idempotent</span> | ||
|
|
||
| Platform: GCP | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Privilege Escalation | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Attempts to impersonate several GCP service accounts. Service account impersonation in GCP allows to retrieve | ||
| temporary credentials allowing to act as a service account. | ||
|
|
||
| <span style="font-variant: small-caps;">Warm-up</span>: | ||
|
|
||
| - Create 10 GCP service accounts | ||
| - Grant the current user <code>roles/iam.serviceAccountTokenCreator</code> on one of these service accounts | ||
|
|
||
| <span style="font-variant: small-caps;">Detonation</span>: | ||
|
|
||
| - Attempt to impersonate each of the service accounts | ||
| - One impersonation request will succeed, simulating a successful privilege escalation | ||
|
|
||
|
|
||
| !!! info | ||
|
|
||
| GCP takes a few seconds to propagate the new <code>roles/iam.serviceAccountTokenCreator</code> role binding to the current user. | ||
|
|
||
| It is recommended to first warm up this attack technique (<code>stratus warmup ...</code>), wait for 30 seconds, then detonate it. | ||
|
|
||
| References: | ||
|
|
||
| - https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-cloud-platform/ | ||
| - https://cloud.google.com/iam/docs/impersonating-service-accounts | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate gcp.privilege-escalation.impersonate-service-accounts | ||
| ``` | ||
| ## Detection | ||
|
|
||
|
|
||
| Using GCP Admin Activity audit logs event <code>GenerateAccessToken</code>. | ||
|
|
||
| Sample successful event (shortened for clarity): | ||
|
|
||
| ```json hl_lines="12 21" | ||
| { | ||
| "protoPayload": { | ||
| "@type": "type.googleapis.com/google.cloud.audit.AuditLog", | ||
| "authenticationInfo": { | ||
| "principalEmail": "user@domain.tld", | ||
| "principalSubject": "user:user@domain.tld" | ||
| }, | ||
| "requestMetadata": { | ||
| "callerIp": "(calling IP)", | ||
| }, | ||
| "serviceName": "iamcredentials.googleapis.com", | ||
| "methodName": "GenerateAccessToken", | ||
| "authorizationInfo": [ | ||
| { | ||
| "permission": "iam.serviceAccounts.getAccessToken", | ||
| "granted": true, | ||
| "resourceAttributes": {} | ||
| } | ||
| ], | ||
| "request": { | ||
| "name": "projects/-/serviceAccounts/impersonated-service-account@project-id.iam.gserviceaccount.com", | ||
| "@type": "type.googleapis.com/google.iam.credentials.v1.GenerateAccessTokenRequest" | ||
| } | ||
| }, | ||
| "resource": { | ||
| "type": "service_account", | ||
| "labels": { | ||
| "unique_id": "105711361070066902665", | ||
| "email_id": "impersonated-service-account@project-id.iam.gserviceaccount.com", | ||
| "project_id": "project-id" | ||
| } | ||
| }, | ||
| "severity": "INFO", | ||
| "logName": "projects/project-id/logs/cloudaudit.googleapis.com%2Fdata_access" | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| When impersonation fails, the generated event **does not contain** the identity of the caller, as explained in the | ||
| [GCP documentation](https://cloud.google.com/logging/docs/audit#user-id): | ||
|
|
||
| > For privacy reasons, the caller's principal email address is redacted from an audit log if the operation is | ||
| > read-only and fails with a "permission denied" error. The only exception is when the caller is a service | ||
| > account in the Google Cloud organization associated with the resource; in this case, the email address isn't redacted. | ||
| Sample **unsuccessful** event (shortened for clarity): | ||
|
|
||
| ```json hl_lines="5 6 13 38" | ||
| { | ||
| "protoPayload": { | ||
| "@type": "type.googleapis.com/google.cloud.audit.AuditLog", | ||
| "status": { | ||
| "code": 7, | ||
| "message": "PERMISSION_DENIED" | ||
| }, | ||
| "authenticationInfo": {}, | ||
| "requestMetadata": { | ||
| "callerIp": "(calling IP)" | ||
| }, | ||
| "serviceName": "iamcredentials.googleapis.com", | ||
| "methodName": "GenerateAccessToken", | ||
| "authorizationInfo": [ | ||
| { | ||
| "permission": "iam.serviceAccounts.getAccessToken", | ||
| "resourceAttributes": {} | ||
| } | ||
| ], | ||
| "resourceName": "projects/-/serviceAccounts/103566171230474107362", | ||
| "request": { | ||
| "@type": "type.googleapis.com/google.iam.credentials.v1.GenerateAccessTokenRequest", | ||
| "name": "projects/-/serviceAccounts/target-service-account@project-id.iam.gserviceaccount.com" | ||
| }, | ||
| "metadata": { | ||
| "identityDelegationChain": [ | ||
| "projects/-/serviceAccounts/target-service-account@project-id.iam.gserviceaccount.com" | ||
| ] | ||
| } | ||
| }, | ||
| "resource": { | ||
| "type": "service_account", | ||
| "labels": { | ||
| "email_id": "target-service-account@project-id.iam.gserviceaccount.com", | ||
| "project_id": "project-id" | ||
| } | ||
| }, | ||
| "severity": "ERROR", | ||
| "logName": "projects/project-id/logs/cloudaudit.googleapis.com%2Fdata_access" | ||
| } | ||
| ``` | ||
|
|
||
| Some detection strategies may include: | ||
|
|
||
| * Alerting on unsuccessful impersonation attempts | ||
| * Alerting when the same IP address / user-agent attempts to impersonate several service accounts in a | ||
| short amount of time (successfully or not) | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| # GCP | ||
|
|
||
| This page contains the Stratus attack techniques for GCP, grouped by MITRE ATT&CK Tactic. | ||
| Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic. | ||
|
|
||
|
|
||
| ## Persistence | ||
|
|
||
| - [Create an Admin GCP Service Account](./gcp.persistence.create-admin-service-account.md) | ||
|
|
||
| - [Create a GCP Service Account Key](./gcp.persistence.create-service-account-key.md) | ||
|
|
||
|
|
||
| ## Privilege Escalation | ||
|
|
||
| - [Create an Admin GCP Service Account](./gcp.persistence.create-admin-service-account.md) | ||
|
|
||
| - [Create a GCP Service Account Key](./gcp.persistence.create-service-account-key.md) | ||
|
|
||
| - [Impersonate GCP Service Accounts](./gcp.privilege-escalation.impersonate-service-accounts.md) | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,4 @@ | ||
| # Supported Platforms | ||
|
|
||
| Stratus Red Team currently supports AWS, Azure, and Kubernetes. | ||
| See [Connecting to your cloud account](https://stratus-red-team.cloud/user-guide/getting-started/#connecting-to-your-cloud-account) for setup instructions. | ||
|
|
||
| ## Future Support for Additional Platforms | ||
|
|
||
| We plan to add support for [GCP](https://github.com/DataDog/stratus-red-team/issues/53) in the future. | ||
| If you're interested, go upvote the corresponding issue! | ||
| Stratus Red Team currently supports AWS, Azure, GCP and Kubernetes. | ||
| See [Connecting to your cloud account](https://stratus-red-team.cloud/user-guide/getting-started/#connecting-to-your-cloud-account) for setup instructions. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.