[Feature Request] Add Python module for detecting T1098.003 - Additional Cloud Roles

未关闭
  • 哪里不对？
#17 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

@terrancedejesus 已经在做这个了。

开始于 2023年5月12日。

评估

这个 Issue 还没有评估数据。

描述

API: Admin enhancement Subtechnique: 003 Tactic: Persistence Technique: T1098

🐍 Python Module for MITRE ATT&CK Technique Detection

Technique Name: Account Manipulation: Additional Cloud Roles

Technique ID: T1098.003

Technique Description: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

This account modification may immediately follow Create Account or other malicious account activity. Adversaries may also modify existing Valid Accounts that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.

Describe the solution you'd like

With authentication from compromised credentials, create a new group or role within Google Workspace. Then create a new user and add the user to this new group or role. As an option from the config, it should be possible to add a default admin role as well which would be a good signal for privilege escalation.

Additional context
Requirements: 
- Google Admin API
- Python packages (google-auth google-auth-oauthlib google-auth-httplib2 google-api-python-client, email, base64)
- Scopes:  https://www.googleapis.com/auth/admin.directory.group and https://www.googleapis.com/auth/admin.directory.user

Module Workflow:
Step 1: What is the group or role to create? Enter a group or role:
Step 2: What is the user to be created? Enter your user email:
Step 3: Create group or role
Step 4: Create the user account
Step 5: Assign the group or role to the user account

Module Actions:
 1. Authenticate
 2. Create group or role
 3. Create user account
 4. Add user to group or role
 5. Cleanup: remove user from group or role
 6. Cleanup: remove group or role
Checklist

Please ensure the following tasks are completed before submitting your feature request:

  • This issue is for a specific MITRE ATT&CK technique detection
  • The technique name and ID are clearly specified
  • The problem and desired solution are clearly described
  • Any necessary alternatives or additional context have been provided
主要语言
Python
星标
171
派生
8
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

elastic/SWAT 的其他 Issue

查看 elastic/SWAT 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。