Yog965/grc-ai-command-deck

1[2  {3    "technique_id": "T1078.004",4    "name": "Valid Accounts: Cloud Accounts",5    "description": "Adversaries may obtain and abuse credentials of existing cloud accounts (e.g., IAM users, root account) to gain initial access, maintain persistence, or escalate privileges without triggering traditional alerts. For example, logging into the console without Multi-Factor Authentication (MFA)."6  },7  {8    "technique_id": "T1098.001",9    "name": "Account Manipulation: Additional Cloud Credentials",10    "description": "Adversaries may add access keys, SSH keys, or API tokens to existing cloud accounts. This allows them to maintain access (persistence) to the environment even if the primary password is changed."11  },12  {13    "technique_id": "T1136.003",14    "name": "Create Account: Cloud Account",15    "description": "Adversaries may create new cloud accounts or IAM users to maintain persistent access to the victim cloud environment, bypassing detection of compromised existing accounts."16  },17  {18    "technique_id": "T1530",19    "name": "Data from Cloud Data Semantics",20    "description": "Adversaries may access data stored in cloud storage buckets (like Amazon S3, Google Cloud Storage, or Azure Blobs) that are misconfigured or publicly exposed to exfiltrate sensitive data."21  },22  {23    "technique_id": "T1562.001",24    "name": "Impair Defenses: Disable or Modify System Firewall",25    "description": "Adversaries may modify security groups, network ACLs, or firewall settings to permit inbound traffic on sensitive ports (e.g., SSH port 22 or RDP port 3389) from unrestricted IP addresses (0.0.0.0/0)."26  },27  {28    "technique_id": "T1578.001",29    "name": "Modify Cloud Infrastructure: Create Infrastructure",30    "description": "Adversaries may spin up new virtual machines, container instances, or serverless functions in a cloud environment to run cryptomining scripts or establish command and control nodes."31  },32  {33    "technique_id": "T1526",34    "name": "Cloud Service Discovery",35    "description": "Adversaries may list and enumerate active cloud services, resources, storage buckets, and IAM roles to map out the infrastructure and plan lateral movement."36  },37  {38    "technique_id": "T1485",39    "name": "Data Destruction",40    "description": "Adversaries may delete critical cloud resources, S3 buckets, or database instances to disrupt organization operations or destroy evidence of intrusion."41  },42  {43    "technique_id": "T1098",44    "name": "Account Manipulation",45    "description": "Adversaries may modify role assumptions, trust policies, or group memberships in IAM to escalate privileges or grant external entities access to internal cloud resources."46  },47  {48    "technique_id": "T1539",49    "name": "Steal Web Session Cookie",50    "description": "Adversaries may capture AWS Management Console session cookies or federated login tokens to bypass Multi-Factor Authentication (MFA) requirements during lateral movement."51  }52]53