Every post here ships with a runnable scenario, a CloudTrail signature, and the detection rule that should catch it. Written by the people shipping the catalogue, peer-reviewed, and never gated.
Most off-the-shelf detection rules look for AttachUserPolicy
with a human principal. The chain we walked attaches to a role,
from a session token issued seconds earlier. We timed the gap, recorded
the trail, and stress-tested seven detection rule sets against it.
// 14:02:11.221 → sts:AssumeRole principal u/maint-bot → 200 (token expires 3600s) → iam:AttachRolePolicy policy arn:aws:iam::aws:policy/AdministratorAccess role r/admin-7f → 200 → iam:CreateUser u/maint-bot-shadow → 200 → iam:CreateAccessKey → 200 // 14:02:23.512 elapsed 12.3s ⚠ T1548.005 detected · GuardDuty · +3.1s ⚠ T1078 detected · Custom · +28.0s ✗ T1098 no rule fired · SOC review only
GuardDuty fires on CreateKey with origin EXTERNAL - but the ALPHV variant we tracked imports material in a separate region first. We ran the chain four ways and only one triggered an alert.
Originally disclosed 2020, AWS partially mitigated by 2022. We measured the window again on five fresh accounts and got 18-second medians. The exploit hasn't been patched - it's been documented.
Pulled from the 2024 DOJ indictment and three IR reports. APT41 stays on three techniques 80% of the time. We've shipped two - the third's on the roadmap.
Most attack labs ship a clean account. Real attackers find prod-shaped accounts - noisy IAM, mixed regions, legacy roles. Here's how we shape ours to mirror that, in Pulumi.
A short list with sources. Two of them are documented, three we found by diffing actual traffic against trail outputs. Treat as a research note, not a complete list.
Average detection coverage gap: 41%. Most-missed technique: T1098 (account manipulation). Most surprising: half the teams already had a rule for it - it just didn't trigger on the chain we ran.
We ran the S3 exfil chain at 12 different request velocities. Below 4 RPS the standard CloudTrail rules don't fire. The interesting band is 8-20 RPS.
When a session originates in us-east-1 but the API calls land in ap-south-1, most off-the-shelf rules don't correlate. We rebuilt three of them to demonstrate the gap.
Python+boto3 was fine for prototyping. For peer review and reproducibility, single-binary distribution mattered. Notes on the migration and what we lost.
One real attack, one detection note, one tool we built. No marketing, no funnels. Sent every other Tuesday by the research team.