Threat hunts for AWS

33 hunts

1. high Part 2 of 2

   Research by Sekoia

   ShinyHunters Cloud Exfiltration and Ransomware

   An adversary is using compromised credentials or OAuth tokens to exfiltrate bulk S3 data and GitHub repositories before deploying ransomware for extortion.

   3 query1 analytic1 checkpoint1 action2 task

   collection · credential access · impact
2. high Part 2 of 2

   Research by The DFIR Report

   Bissa Scanner C2 and S3 Exfiltration

   An attacker is using Telegram for command-and-control alerts and Filebase S3 for data exfiltration after harvesting secrets from vulnerable application servers.

   3 query1 analytic1 checkpoint1 action2 task

   CVE-2025-55182 · CVE-2025-9501
3. high Part 1 of 2

   Research by The DFIR Report

   Bissa Scanner Mass Exploitation and Credential Harvesting

   An attacker is using the Bissa scanner to exploit unauthenticated vulnerabilities in Next.js or WordPress, then harvesting sensitive credentials from .env files and cloud metadata.

   3 query2 analytic2 checkpoint1 action2 task

   CVE-2025-55182 · CVE-2025-9501
4. high

   Research by Elastic Security Labs

   Rapid Phishing and Proxy-based Exfiltration

   An adversary has bypassed phishing-resistant MFA to gain initial access via a SaaS provider and is now using a multi-hop proxy or tunnel to exfiltrate data from an internal host.

   3 query2 analytic2 checkpoint1 action2 task

   command and control · exfiltration · initial access
5. medium

   Research by Elastic Security Labs

   Endpoint-to-Cloud Phased Intrusion Hunt

   An adversary establishes a beachhead on an endpoint, moves laterally to obtain administrative access, and pivots to cloud services while maintaining C2 via a multi-hop proxy.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · credential access · execution
6. medium

   Research by Microsoft

   Managed Access and Tenant Integrity

   An adversary has established persistence via cross-tenant delegated administration or unattended remote support, subsequently deploying autonomous agents that communicate through multi-hop proxies.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · execution · persistence
7. medium

   Research by Elastic Security Labs

   Vulnerable Driver Exploitation and Kernel Escalation

   An adversary has exploited a public-facing application to stage and load a vulnerable kernel driver, bypassing security controls to gain persistent high-integrity access to the host.

   4 query2 analytic2 checkpoint1 action2 task

   execution · initial access · privilege escalation
8. medium Part 2 of 2

   Research by Microsoft

   Cloud Workload Identity and Network Triage

   An adversary uses over-permissioned cloud identities to compromise container workloads, establishing persistence through rare outbound network channels that bypass standard scanning.

   3 query1 analytic1 checkpoint1 action2 task

   command and control · credential access · defense evasion
9. medium Part 1 of 2

   Research by Microsoft

   Cloud Workload Runtime and Exploitation Behavior

   An adversary has exploited a public-facing containerized application and is maintaining persistence through binary drift or suspicious shell execution within the workload runtime.

   3 query2 analytic2 checkpoint1 action3 task

   command and control · credential access · defense evasion
10. high Part 1 of 2

    Research by Unit 42

    Build-Time Execution and Secret Harvesting

    An attacker has compromised a software dependency to execute malicious code during the build phase, subsequently harvesting cloud and developer credentials from the environment's configuration files.

    3 query1 analytic1 checkpoint2 task

    CVE-2024-3094
11. high

    Research by Elastic Security Labs

    AWS Cloud Identity Takeover Chain

    An adversary has gained initial access to a cloud account by brute-forcing the console and performing a password reset, then used that access to establish a presence across multiple projects in the organization.

    5 query2 analytic1 checkpoint1 action2 task

    initial access · persistence · privilege escalation
12. medium Part 2 of 2

    Research by Unit 42

    Anomalous Cloud Identity Behavior

    An adversary has compromised an administrative cloud identity and is accessing the environment through multi-hop proxies or Tor to perform discovery and initial access.

    3 query2 analytic2 checkpoint1 action2 task

    command and control · discovery · execution
13. medium Part 1 of 2

    Research by Unit 42

    Public app exploitation and cloud identity drift

    An adversary has exploited a public-facing application on a cloud instance to obtain its identity, which is now being used for activity that deviates from the host's established behavioral profile.

    5 query1 analytic1 checkpoint1 action2 task

    command and control · discovery · execution
14. high

    Research by Elastic Security Labs

    Obfuscated Identity and Host Access

    An adversary is using multi-hop proxies or tunnels to mask their origin during authentication to cloud identity providers, subsequently using that access to reach internal hosts and execute local commands.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · execution · initial access
15. high Part 2 of 2

    Research by Huntress

    Tampered Exodus Wallet Persistence and C2

    An intruder has deployed a tampered Exodus wallet that suppresses its UI and maintains persistence through a headless PowerShell scheduled task while communicating with a hardcoded C2 IP.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · defense evasion · execution
16. high Part 2 of 2

    Research by Unit 42

    Spring Ring: NTLM Relay and RAT C2

    An attacker has deployed a custom Python environment to facilitate NTLM relay attacks and a PowerShell-based RAT that beacons to external command-and-control infrastructure.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · defense evasion · discovery
17. high Part 1 of 2

    Research by Unit 42

    Microsoft Teams Vishing and Malicious Payload Execution

    An adversary is using external Microsoft Teams accounts to masquerade as IT support and coerce employees into executing RMM tools or custom payloads that perform discovery and persistence.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · defense evasion · discovery
18. high Part 3 of 3

    Research by Datadog Security Labs

    Shai-Hulud: Exfiltration and Deadman Switch

    An attacker is using the Shai-Hulud framework to exfiltrate stolen credentials through GitHub dead-drops and has installed a destructive deadman switch that triggers a home-directory wipe if tokens are revoked.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · credential access · discovery
19. high Part 2 of 3

    Research by Datadog Security Labs

    Shai-Hulud Secret Harvesting and Discovery

    An intruder has deployed the Shai-Hulud framework to extract credentials from filesystem paths and process memory, subsequently using them to automate the discovery of cloud and Kubernetes infrastructure secrets.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · credential access · discovery
20. high Part 1 of 3

    Research by Datadog Security Labs

    Shai-Hulud Framework Supply Chain Hook and Loader Bootstrap

    The adversary poisons a developer repository or AI coding assistant configuration to execute the Shai-Hulud loader and establish daemonized persistence.

    3 query2 analytic2 checkpoint1 action2 task

    command and control · credential access · discovery
21. medium

    Research by Elastic Security Labs

    Suspicious ingress tool transfer via native utilities

    An adversary is using native Linux or macOS utilities like curl or wget to download malicious payloads from external infrastructure, hiding their activity within the high volume of legitimate cloud automation.

    3 query1 analytic1 checkpoint1 action2 task

    command and control
22. high Part 2 of 2

    Research by Unit 42

    AMOS Stealer C2 and Exfiltration Patterns

    An adversary exfiltrates keychain, browser, and wallet data from macOS hosts by sending a sequence of HTTP POST requests containing specific stage parameters to malicious infrastructure.

    3 query1 analytic1 checkpoint1 action2 task

    collection · command and control · execution
23. high Part 1 of 2

    Research by Unit 42

    Atomic macOS (AMOS) Stealer Activity

    An adversary has compromised a macOS host using deceptive Terminal setup commands to execute encoded shell scripts, establishing hidden persistence in Application Support and staging harvested data in temporary directories.

    5 query2 analytic1 checkpoint1 action2 task

    collection · command and control · execution
24. high Part 2 of 2

    Research by Huntress

    PaperCut NG and MF Pre-Auth RCE Exploitation

    An unauthenticated intruder has exploited PaperCut NG/MF authorization bypass and unsafe class loading to execute arbitrary Java bytecode, profiled the system, and deleted server logs to hide their activities.

    5 query2 analytic1 checkpoint1 action2 task

    CVE-2026-81578 · CVE-2026-82078
25. high Part 2 of 2

    Research by Elastic Security Labs

    CHAINDROP: C2 Discovery and Worm Propagation

    An attacker has infected local development environments via trojanized npm packages and is using Ethereum smart contracts to discover C2 infrastructure before propagating the worm using stolen GitHub credentials.

    4 query1 analytic1 checkpoint1 action2 task

    command and control · credential access · execution
26. high Part 1 of 2

    Research by Elastic Security Labs

    CHAINDROP: Host-Based Node.js Worm Execution and Harvesting

    An attacker has gained initial access through a backdoored npm package preinstall hook, which executes a dropper to install a rogue Bun runtime and harvest developer credentials from local IDE configurations.

    3 query2 analytic2 checkpoint1 action2 task

    command and control · credential access · execution
27. high Part 2 of 2

    Research by Huntress

    GTA 6 Hype: RAT C2 and Data Theft

    An adversary is leveraging Grand Theft Auto VI hype to deploy RATs and infostealers that use ngrok tunnels for command and control and Discord for credential exfiltration.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · credential access · execution
28. high Part 1 of 2

    Research by Huntress

    GTA6 Malicious Installer and Chaos Wiper Activity

    An intruder is exploiting GTA6 hype to deploy a fake installer that stages multiple RATs and executes a destructive wiper masquerading as ransomware.

    4 query2 analytic2 checkpoint1 action2 task

    command and control · credential access · execution
29. high Part 1 of 2

    Research by Wiz

    TeamPCP Credential Validation and Discovery

    An adversary validates stolen cloud credentials and enumerates cloud infrastructure using offensive tools like TruffleHog or specialized Boto3 scripts following a supply chain compromise.

    4 query1 analytic1 checkpoint1 action2 task

    discovery · execution · exfiltration
30. high Part 2 of 3

    Research by Cisco Talos

    UAT-10147: Host Elevation and Evasion

    An adversary is executing automated staging scripts to deploy privilege escalation tools and blind security software on compromised web servers.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · defense evasion · discovery
31. high Part 1 of 3

    Research by Cisco Talos

    Web Exploit and Telemetry Theft (UAT-10147)

    The adversary exploits known web vulnerabilities in Zimbra, Telerik, or AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos configuration server via HTTP POST requests.

    3 query1 analytic1 checkpoint1 action2 task

    command and control · defense evasion · discovery
32. high Part 2 of 2

    Research by Huntress

    RMM-Driven Endpoint Lateral Movement and Masquerading

    An intruder who has compromised an N-central appliance is abusing the Take Control feature to drop masqueraded binaries in user folders and perform process enumeration on managed hosts.

    3 query1 analytic1 checkpoint1 action2 task

    CVE-2026-18556 · CVE-2026-18577
33. high Part 1 of 2

    Research by Huntress

    N-central Web Exploitation and Persistence

    An attacker has exploited unauthenticated N-central web vulnerabilities to gain administrative control, subsequently establishing persistence through rogue user accounts and Cloudflare protocol tunnels.

    5 query2 analytic1 checkpoint1 action2 task

    CVE-2026-18556 · CVE-2026-18577