Add references to aws.persistence.iam-create-user-login-profile

DataDog · Feb 28, 2023 · c098e26 · c098e26
1 parent 370a454
commit c098e26
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/v2/internal/attacktechniques/aws/persistence/iam-create-user-login-profile/main.go b/v2/internal/attacktechniques/aws/persistence/iam-create-user-login-profile/main.go
@@ -29,6 +29,11 @@ Warm-up:
 Detonation: 
 
 - Create an IAM Login Profile on the user
+
+References:
+- https://permiso.io/blog/s/approach-to-detection-androxgh0st-greenbot-persistence/
+- https://blog.darklab.hk/2021/07/06/trouble-in-paradise/
+- https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/
 `,
 		Detection: `
 Through CloudTrail's <code>CreateLoginProfile</code> or <code>UpdateLoginProfile</code> events.