mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-04 16:57:26 -08:00
90 lines
4.2 KiB
Markdown
90 lines
4.2 KiB
Markdown
# AWS - Security Hub Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Security Hub
|
|
|
|
**Security Hub** collects security **data** from **across AWS accounts**, services, and supported third-party partner products and helps you **analyze your security** trends and identify the highest priority security issues.
|
|
|
|
It **centralizes security related alerts across accounts**, and provides a UI for viewing these. The biggest limitation is it **does not centralize alerts across regions**, only across accounts
|
|
|
|
**Characteristics**
|
|
|
|
* Regional (findings don't cross regions)
|
|
* Multi-account support
|
|
* Findings from:
|
|
* Guard Duty
|
|
* Config
|
|
* Inspector
|
|
* Macie
|
|
* third party
|
|
* self-generated against CIS standards
|
|
|
|
## Enumeration
|
|
|
|
```
|
|
# Get basic info
|
|
aws securityhub describe-hub
|
|
|
|
# Get securityhub org config
|
|
aws securityhub describe-organization-configuration #If the current account isn't the security hub admin, you will get an error
|
|
|
|
# Get the configured admin for securityhub
|
|
aws securityhub get-administrator-account
|
|
aws securityhub get-master-account # Another way
|
|
aws securityhub list-organization-admin-accounts # Another way
|
|
|
|
# Get enabled standards
|
|
aws securityhub get-enabled-standards
|
|
|
|
# Get the findings
|
|
aws securityhub get-findings
|
|
|
|
# Get insights
|
|
aws securityhub get-insights
|
|
|
|
# Get Automation rules (must be from the admin account)
|
|
aws securityhub list-automation-rules
|
|
|
|
# Get members (must be from the admin account)
|
|
aws securityhub list-members
|
|
aws securityhub get-members --account-ids <acc-id>
|
|
```
|
|
|
|
## Bypass Detection
|
|
|
|
TODO, PRs accepted
|
|
|
|
## References
|
|
|
|
* [https://cloudsecdocs.com/aws/services/logging/other/#general-info](https://cloudsecdocs.com/aws/services/logging/other/#general-info)
|
|
* [https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html)
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|