Cloud Offensive Framework Execution

  1[metadata]
  2creation_date = "2026/09/14"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/10/08"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies execution of well-known cloud exploitation, enumeration, and attack-simulation frameworks on an endpoint.
 11Adversaries run these after obtaining cloud credentials to map the compromised principal's effective permissions,
 12discover privilege escalation paths, and pivot to the console. Pacu is tracked by MITRE as software S1091. Real-world
 13use on compromised hosts is documented in the AWS customer incident catalog, where both the Unit 42 SugarCRM zero-day
 14response and the AWS CIRT federated-user compromise record Pacu and ScoutSuite scanning from access keys found on EC2
 15hosts.
 16
 17Covered frameworks include: Pacu, CloudFox, ScoutSuite, PMapper, Stratus Red Team, WeirdAAL, enumerate-iam, Prowler,
 18CloudMapper, CloudSplaining, cloud_enum, CloudBrute, SkyArk, Leonidas, Halberd, Barq, Cartography, Nimbostratus,
 19AWSBucketDump, dsnap, aws_consoler, Redboto, cloudjack, s3scanner, CloudSploit, aws-enumerator, iam-vulnerable, Fog,
 20and SmogCloud. Secret scanners such as TruffleHog and Gitleaks are intentionally excluded because they run routinely in
 21CI and pre-commit hooks; their credential-validation use is covered by CloudTrail and GitHub user-agent rules.
 22
 23Authorized red team and cloud audit activity uses the same tooling, so alerts should be correlated with known
 24assessment windows and operators.
 25"""
 26false_positives = [
 27    """
 28    Authorized red team engagements and cloud security assessments use the same frameworks. Correlate with known
 29    assessment windows, operator identities, and approved change records before escalating.
 30    """,
 31    """
 32    Security engineers running Prowler, ScoutSuite, or Cartography on a schedule for compliance or asset inventory will
 33    trigger this rule. Add host or user exceptions for known security tooling environments.
 34    """,
 35]
 36from = "now-9m"
 37index = ["logs-endpoint.events.process*"]
 38language = "kuery"
 39license = "Elastic License v2"
 40name = "Cloud Offensive Framework Execution"
 41note = """## Triage and analysis
 42
 43### Investigating Cloud Offensive Framework Execution
 44
 45This rule fires when a known cloud offensive, enumeration, or attack-simulation framework starts on an endpoint, either as a standalone binary or through a Python, Go, Node, uv, or pipx launcher whose command line references the tool. These frameworks are what an adversary reaches for immediately after obtaining cloud credentials: Pacu and CloudFox for privilege escalation paths, ScoutSuite and Prowler for account-wide enumeration, PMapper and CloudMapper for IAM graphing, Stratus Red Team, Leonidas, and Halberd for scripted attack chains.
 46
 47### Possible investigation steps
 48
 49- Review `process.command_line` and `process.working_directory` to identify the framework, the modules or checks invoked, and any `--profile`, `--role`, or credential file arguments that show which cloud principal is being used.
 50- Identify the parent process and user. An interactive terminal under a security engineer's account differs from a launcher spawned by a web server, cron, CI runner, or a process running from `/tmp`.
 51- Check whether cloud credentials exist on the host (`~/.aws/credentials`, environment variables, instance metadata) and whether they were recently created or accessed.
 52- Pivot to CloudTrail or the equivalent cloud audit log for the same principal and time window. Pacu and ScoutSuite generate bursts of `Describe*`, `List*`, and `Get*` calls; PMapper and CloudFox add `iam:Simulate*` and `sts:GetCallerIdentity`.
 53- Look for follow-on activity on the host: new IAM users or keys, `aws sts assume-role`, `aws_consoler` console federation, or outbound connections from the same process tree.
 54- Correlate with `Potential Linux Hack Tool Launched` and with the CloudTrail rules `AWS IAM User Self Created Access Key Subsequently Used` and `Suspicious User Agent Detected in CloudTrail`.
 55
 56### False positive analysis
 57
 58- Scheduled Prowler, ScoutSuite, or Cartography runs from a dedicated security or compliance host. Verify the host, user, and schedule, then add an exception scoped to that host and user rather than to the tool name.
 59- Red team or purple team engagements. Confirm against the engagement record and time window.
 60- Developers building or testing a framework from source. `go build`, `go test`, `pip install`, and `pytest` are excluded; if a build system uses other commands, exclude by parent process rather than by tool name.
 61
 62### Response and remediation
 63
 64- If not authorized, isolate the host and terminate the process tree.
 65- Identify every cloud principal whose credentials were present on the host and rotate or revoke them. Treat any key used by the framework as compromised.
 66- Review CloudTrail for the principal from the first framework execution onward, looking for privilege escalation (`iam:CreateAccessKey`, `iam:AttachUserPolicy`, `iam:UpdateAssumeRolePolicy`), persistence (new users, roles, Lambda functions), and data access.
 67- Remove the framework, its virtual environment, and any session or credential caches it created (for example Pacu's session database).
 68- Escalate to the cloud incident response process if the principal had privileges beyond read-only enumeration.
 69"""
 70references = [
 71    "https://www.uptycs.com/blog/threat-research-report-team/threat-actor-mitigation-with-cloud-security",
 72    "https://github.com/ramimac/aws-customer-security-incidents",
 73    "https://unit42.paloaltonetworks.com/sugarcrm-cloud-incident-black-hat/",
 74    "https://github.com/RhinoSecurityLabs/pacu",
 75    "https://github.com/BishopFox/cloudfox",
 76    "https://github.com/nccgroup/ScoutSuite",
 77    "https://github.com/nccgroup/PMapper",
 78    "https://stratus-red-team.cloud/",
 79    "https://github.com/duo-labs/cloudmapper",
 80    "https://github.com/salesforce/cloudsplaining",
 81    "https://github.com/cyberark/SkyArk",
 82    "https://github.com/FSecureLABS/leonidas",
 83    "https://github.com/vectra-ai-research/Halberd",
 84    "https://github.com/prisma-cloud/dsnap",
 85]
 86risk_score = 47
 87rule_id = "77c476eb-6a49-402a-a561-267ae66daa5e"
 88setup = """## Setup
 89
 90This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 91
 92Setup instructions: https://ela.st/install-elastic-defend
 93"""
 94severity = "medium"
 95tags = [
 96    "Domain: Endpoint",
 97    "Domain: Cloud",
 98    "Platform: AWS",
 99    "Platform: Linux",
100    "Platform: macOS",
101    "Platform: Windows",
102    "OS: Linux",
103    "OS: macOS",
104    "OS: Windows",
105    "Use Case: Threat Detection",
106    "Tactic: Discovery",
107    "Tactic: Execution",
108    "Data Source: Elastic Defend",
109    "Rule Type: Custom Query (KQL)",
110    "Resources: Investigation Guide",
111]
112timestamp_override = "event.ingested"
113type = "query"
114
115query = '''
116event.category : "process" and event.type : "start" and event.action:(start or exec) and 
117(
118  process.name : (
119    pacu or pacu.exe or cloudfox or cloudfox.exe or
120    weirdaal or "enumerate-iam" or enumerate_iam or scoutsuite or pmapper or
121    prowler or prowler.exe or cloudmapper or cloudsplaining or cloud_enum or
122    cloudbrute or cloudbrute.exe or nimbostratus or "aws-enumerator" or "aws-enumerator.exe" or
123    skyark or awsbucketdump or dsnap or aaia or
124    aws_consoler or awsconsoler or redboto or cloudjack or s3scanner or s3scanner.exe or
125    cloudsploit or "iam-vulnerable" or smogcloud
126  ) or
127  (process.name : (stratus or stratus.exe) and process.args : (detonate or warmup or revert or cleanup)) or
128  (process.name : cartography and process.args : ("--aws-sync-all-profiles" or "--aws-requested-syncs")) or
129  (
130    process.name : (python* or pipx or uv or uvx or go or node) and
131    process.command_line : (
132      *cloudfox* or *enumerate_iam* or *enumerate-iam* or *weirdAAL* or *aws_consoler* or
133      *-m pacu* or *pacu.py* or *aws_escalate* or *scoutsuite* or *pmapper* or
134      *cloudmapper* or *cloudsplaining* or *nimbostratus* or *leonidas-framework* or
135      *cloud_enum* or *halberd* or *skyark* or *awsbucketdump* or *stratus-red-team* or
136      *prowler* or *cloudsploit* or *cloudbrute* or *fog-aws* or *barq*
137    )
138  )
139) and not process.command_line : (
140  *pip install* or *pip3 install* or *pipx install* or *uv pip install* or *uv tool install* or
141  *go get* or *go install* or *go build* or *go test* or *npm install* or *--help* or *--version* or
142  *git clone* or *pytest* or "*site-packages/pip*"
143) and not process.parent.name : (dpkg or rpm or apt or yum or dnf or brew or pip or pip3)
144'''
145
146[[rule.threat]]
147framework = "MITRE ATT&CK"
148
149[[rule.threat.technique]]
150id = "T1580"
151name = "Cloud Infrastructure Discovery"
152reference = "https://attack.mitre.org/techniques/T1580/"
153
154[[rule.threat.technique]]
155id = "T1069"
156name = "Permission Groups Discovery"
157reference = "https://attack.mitre.org/techniques/T1069/"
158
159[[rule.threat.technique.subtechnique]]
160id = "T1069.003"
161name = "Cloud Groups"
162reference = "https://attack.mitre.org/techniques/T1069/003/"
163
164[rule.threat.tactic]
165id = "TA0007"
166name = "Discovery"
167reference = "https://attack.mitre.org/tactics/TA0007/"
168
169[[rule.threat]]
170framework = "MITRE ATT&CK"
171
172[[rule.threat.technique]]
173id = "T1059"
174name = "Command and Scripting Interpreter"
175reference = "https://attack.mitre.org/techniques/T1059/"
176
177[[rule.threat.technique.subtechnique]]
178id = "T1059.006"
179name = "Python"
180reference = "https://attack.mitre.org/techniques/T1059/006/"
181
182[rule.threat.tactic]
183id = "TA0002"
184name = "Execution"
185reference = "https://attack.mitre.org/tactics/TA0002/"
186
187[rule.alert_suppression]
188group_by = ["host.id", "process.name", "process.command_line"]
189missing_fields_strategy = "suppress"
190
191[rule.alert_suppression.duration]
192unit = "h"
193value = 1