CloudCopy
This tool implements a cloud version of the Shadow Copy attack against domain controllers running in AWS. Any AWS user possessing the EC2:CreateSnapshot permission can steal the hashes of all domain users by creating a snapshot of the Domain Controller mounting it to an instance they control and exporting the NTDS.dit and SYSTEM registry hive file for use with Impacket's secretsdump project. Demos CloudCopy in Profile mode running against an AWS Domain Controller with an unencrypted Volume. CloudCopy in Manual mode running against an AWS Domain Controller with an encrypted Volume. Detailed CloudCopy Algorithm: Load AWS CLI with Victim Credentials that have at least CreateSnapshot permissions. Run 'Describe-Instances' and show in list for attacker to select. Run 'Create-Snapshot' on volume of selected instance. Run 'modify-snapshot-attribute' on new snapshot to set 'createVolumePermission' to attacker AWS Account. Load AWS CLI with Attacker Credentials. Run 'run-instance' command to create new Linux EC2 with our stolen snapshot. SSH run 'sudo mkdir /windows'. SSH run 'sudo mount /dev/xvdf1 /windows/'. SSH run 'sudo cp /windows/Windows/NTDS/ntds.dit /home/ec2-user'. SSH run 'sudo cp /w
FEATURES
ALTERNATIVES
Detect off-instance key usage in AWS by analyzing CloudTrail files locally.
A fully managed service that securely stores, rotates, and manages sensitive data such as database credentials and API keys.
Kube-bench is a tool for checking Kubernetes security based on CIS Kubernetes Benchmark.
Burp extension for identifying cloud buckets and testing for vulnerabilities
A tool that discovers all AWS resources created in an account
Discover and understand the Docker Layer 2 ICC Bug and its implications on inter-container communication.
A cloud security platform that combines Kubernetes security scanning, runtime monitoring, and cloud security posture management using Kubescape and eBPF technology.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.