The blog post discusses a common technique used by threat actors to evade detection and control within AWS environments. Specifically, it focuses on how attackers manipulate AWS Organizations to remove accounts from the governance controls that an organization has set up. This is often done after gaining initial access through compromised credentials or other means.
Key Points:
-
Technique Description:
- Attackers use this technique to disable security measures like CloudTrail and GuardDuty.
- They separate affected AWS accounts from the broader organizational structure, thereby reducing visibility and control over these accounts.
-
Detection of This Technique:
- The post highlights that detecting such actions is crucial for maintaining security posture.
- It mentions that this technique is part of a larger pattern where attackers try to remove accounts from governance controls provided by AWS Organizations.
-
Preventive Measures:
- Implement the
DenyLeaveOrganizationSCPpolicy: This Service Control Policy (SCP) prevents users from removing their account from an organization. - Secure Root Accounts: Enable multi-factor authentication (MFA), delete root access keys, and manage root credentials centrally to reduce risk.
- Review IAM Permissions: Ensure that permissions are tightly controlled and do not allow wide-ranging actions
- Implement the
Read the full article at AWS Security Blog
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
4
Contents
Ali NematiWritten by Ali
