Add references to aws.persistence.iam-create-admin-user

DataDog · Feb 28, 2023 · 370a454 · 370a454
1 parent eb63922
commit 370a454
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/v2/internal/attacktechniques/aws/persistence/iam-create-admin-user/main.go b/v2/internal/attacktechniques/aws/persistence/iam-create-admin-user/main.go
@@ -27,6 +27,12 @@ Warm-up: None.
 Detonation: 
 
 - Create the IAM user and attach the 'AdministratorAccess' managed IAM policy to it.
+
+References:
+
+- https://permiso.io/blog/s/approach-to-detection-androxgh0st-greenbot-persistence/
+- https://blog.darklab.hk/2021/07/06/trouble-in-paradise/
+- https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/
 `,
 		Detection: `
 Through CloudTrail's <code>CreateUser</code>, <code>AttachUserPolicy</code> and <code>CreateAccessKey</code> events.