Lab: Adversary Simulation Detection with Stratus Red Team and GuardDuty
Detecting Adversaries with GuardDuty
Already Know Terraform?
If you're already familiar with Terraform, feel free to hop over to the AWS Security Cookbook by Tyler GitHub repository to grab and deploy the code. Otherwise, stick around and we'll walk through it together!
Overview
In this lab, we'll explore a free tool from DataDog called Stratus Red Team. To keep things short, I'll just refer to it as "stratus" from here on out. Stratus enables us to simulate adversarial attacks against cloud environments like AWS using attack techniques aligned to MITRE ATT&CK. It's a useful tool for evaluating our defenses and ensuring the ability to detect these techniques. We'll take a look at how we can use GuardDuty to detect some of these threats although it will not be able to detect everything. This is why it's crucial to continuously be testing our detection ability.
Deployment
Cost Alert
AWS GuardDuty is a paid service. Enabling related protection plans and features has an additional cost.
Stratus Red Team deploys resources to your account, so depending on the attacks you choose to use, there may be additional costs.
# clone the AWS Security Cookbook repository
git clone https://github.com/Ty182/AWS-Security-Cookbook-by-Tyler
# navigate to AWS GuardDuty directory
cd AWS_Cookbook_by_Tyler/recipes/aws_guardduty/Lab:Deploying_AWS_GuardDuty_via_Terraform
# initialize the directory and download the required terraform providers
terraform init
# check formatting and validate the syntax is correct
terraform fmt && terraform validate
# check the resources that will be created
terraform plan
# deploy the resources
terraform applyValidating Deployment
Make sure that your GuardDuty instance is functioning. You can run this command to check the presence of a detector. (Your detector id will be different)
Stratus Red Team
Installation
The official GitHub repo for stratus provides installation instructions. I'll be using Homebrew to install like so,
We can then validate it installed,
Documentation
Stratus provides nice documentation so I won't duplicate here. Check out the User Guide or view all the types of attacks to dive deeper.
Attack Simulation
Disabling CloudTrail Logging
AWS GuardDuty is able to detect when CloudTrail logging gets disabled via Stealth:IAMUser/CloudTrailLoggingDisabled without enabling additional protection plans. Stratus can be used to test the detection. It works by creating a new CloudTrail trail and then stopping the trail.
Detonating the attack
Checking trail status
We should be able to see the trail in AWS.
And check whether it's logging or not (it should be set to false)
Detecting the attack
Give this some time for the detection to show up. For me it took 17 minutes before the finding was available.
Clicking into this detection we can get some more info about the attack and the resources impacted.
Cleaning up the attack
S3 Ransomeware via Client-Side Encryption
AWS GuardDuty detected this S3 ransomware attack via AttackSequence:S3/CompromisedData which requires the S3 Protection Plan. Stratus can be used to test the detection. It works by creating an S3 bucket with objects and then re-encrypting them with an external KMS key thereby mimicking a ransomware attack.
Detonating the attack
Detecting the attack
Give this some time for the detection to show up. For me it took nearly an hour before the finding was available.
Clicking into this detection we can get some more info about the attack and the resources impacted.
Cleaning up the attack
Backdoor an IAM User
AWS GuardDuty will not detect this technique unless it can be correlated with other anomalous/suspicious activity. Stratus creates an IAM Access Key for an IAM User which is a technique adversaries might use to maintain access in an environment. IAM Users can have up to 2 access keys.
Detonating the attack
Checking IAM User
We can validate the access key was created.
Detecting the attack
As mentioned, GuardDuty doesn't pick up on this particular action unless the access key is later used for malicious/anomalous activity which can be picked up by other GuardDuty findings types. However, we can rely on CloudTrail logs to discover the activity (and the same can be done for the other attacks).
If there isn't a CloudTrail lab by the time you're reading this, I'll have one in the future.
The CloudTrail event name is called CreateAccessKey and the raw log can be seen below.
Cleaning up the attack
Cleanup
Last updated
Was this helpful?