mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-05 01:07:11 -08:00
146 lines
6.7 KiB
Markdown
146 lines
6.7 KiB
Markdown
# AWS - Macie Enum
|
|
|
|
## AWS - Macie Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Macie
|
|
|
|
Amazon Macie stands out as a service designed to **automatically detect, classify, and identify data** within an AWS account. It leverages **machine learning** to continuously monitor and analyze data, primarily focusing on detecting and alerting against unusual or suspicious activities by examining **cloud trail event** data and user behavior patterns.
|
|
|
|
Key Features of Amazon Macie:
|
|
|
|
1. **Active Data Review**: Employs machine learning to review data actively as various actions occur within the AWS account.
|
|
2. **Anomaly Detection**: Identifies irregular activities or access patterns, generating alerts to mitigate potential data exposure risks.
|
|
3. **Continuous Monitoring**: Automatically monitors and detects new data in Amazon S3, employing machine learning and artificial intelligence to adapt to data access patterns over time.
|
|
4. **Data Classification with NLP**: Utilizes natural language processing (NLP) to classify and interpret different data types, assigning risk scores to prioritize findings.
|
|
5. **Security Monitoring**: Identifies security-sensitive data, including API keys, secret keys, and personal information, helping to prevent data leaks.
|
|
|
|
Amazon Macie is a **regional service** and requires the 'AWSMacieServiceCustomerSetupRole' IAM Role and an enabled AWS CloudTrail for functionality.
|
|
|
|
### Alert System
|
|
|
|
Macie categorizes alerts into predefined categories like:
|
|
|
|
* Anonymized access
|
|
* Data compliance
|
|
* Credential Loss
|
|
* Privilege escalation
|
|
* Ransomware
|
|
* Suspicious access, etc.
|
|
|
|
These alerts provide detailed descriptions and result breakdowns for effective response and resolution.
|
|
|
|
### Dashboard Features
|
|
|
|
The dashboard categorizes data into various sections, including:
|
|
|
|
* S3 Objects (by time range, ACL, PII)
|
|
* High-risk CloudTrail events/users
|
|
* Activity Locations
|
|
* CloudTrail user identity types, and more.
|
|
|
|
### User Categorization
|
|
|
|
Users are classified into tiers based on the risk level of their API calls:
|
|
|
|
* **Platinum**: High-risk API calls, often with admin privileges.
|
|
* **Gold**: Infrastructure-related API calls.
|
|
* **Silver**: Medium-risk API calls.
|
|
* **Bronze**: Low-risk API calls.
|
|
|
|
### Identity Types
|
|
|
|
Identity types include Root, IAM user, Assumed Role, Federated User, AWS Account, and AWS Service, indicating the source of requests.
|
|
|
|
### Data Classification
|
|
|
|
Data classification encompasses:
|
|
|
|
* Content-Type: Based on detected content type.
|
|
* File Extension: Based on file extension.
|
|
* Theme: Categorized by keywords within files.
|
|
* Regex: Categorized based on specific regex patterns.
|
|
|
|
The highest risk among these categories determines the file's final risk level.
|
|
|
|
### Research and Analysis
|
|
|
|
Amazon Macie's research function allows for custom queries across all Macie data for in-depth analysis. Filters include CloudTrail Data, S3 Bucket properties, and S3 Objects. Moreover, it supports inviting other accounts to share Amazon Macie, facilitating collaborative data management and security monitoring.
|
|
|
|
### Enumeration
|
|
|
|
```
|
|
# Get buckets
|
|
aws macie2 describe-buckets
|
|
|
|
# Org config
|
|
aws macie2 describe-organization-configuration
|
|
|
|
# Get admin account (if any)
|
|
aws macie2 get-administrator-account
|
|
aws macie2 list-organization-admin-accounts # Run from the management account of the org
|
|
|
|
# Get macie account members (run this form the admin account)
|
|
aws macie2 list-members
|
|
|
|
# Check if automated sensitive data discovey is enabled
|
|
aws macie2 get-automated-discovery-configuration
|
|
|
|
# Get findings
|
|
aws macie2 list-findings
|
|
aws macie2 get-findings --finding-ids <ids>
|
|
aws macie2 list-findings-filters
|
|
aws macie2 get -findings-filters --id <id>
|
|
|
|
# Get allow lists
|
|
aws macie2 list-allow-lists
|
|
aws macie2 get-allow-list --id <id>
|
|
|
|
# Get different info
|
|
aws macie2 list-classification-jobs
|
|
aws macie2 list-classification-scopes
|
|
aws macie2 list-custom-data-identifiers
|
|
```
|
|
|
|
#### Post Exploitation
|
|
|
|
{% hint style="success" %}
|
|
From an attackers perspective, this service isn't made to detect the attacker, but to detect sensitive information in the stored files. Therefore, this service might **help an attacker to find sensitive info** inside the buckets.\
|
|
However, maybe an attacker could also be interested in disrupting it in order to prevent the victim from getting alerts and steal that info easier.
|
|
{% endhint %}
|
|
|
|
TODO: PRs are welcome!
|
|
|
|
## References
|
|
|
|
* [https://cloudacademy.com/blog/introducing-aws-security-hub/](https://cloudacademy.com/blog/introducing-aws-security-hub/)
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|