Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

94Reachable catalog records

2 / 4Current catalog page

24Maximum records per page

0Samples downloaded by this page

94 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED

REPORT1 SOURCE

Misconfigured Resource-Based Policies

Common misconfigurations of resource-based policies and how they can be abused.

First reported Nov 24, 2022 22:14 UTCOpen evidence record

REPORT1 SOURCE

Soft Deleted Blobs

Recovering and accessing files in private Storage Accounts that have been deleted.

First reported Mar 17, 2022 14:35 UTCOpen evidence record

REPORT1 SOURCE

EC2 Privilege Escalation Through User Data

How to escalate privileges on an EC2 instance by abusing user data.

First reported Jan 21, 2024 17:59 UTCOpen evidence record

REPORT1 SOURCE

Why Recreating an IAM Role Doesn't Restore Trust: A Gotcha in Role ARNs

In AWS, deleting and recreating an IAM role results in a new identity that breaks existing trust policies. This behavior improves security by preventing identity spoofing but can cause failures in cross-account access and third-party integrations if not properly understood.

First reported May 05, 2025 14:08 UTCOpen evidence record

REPORT1 SOURCE

Metadata in Google Cloud Instances

Information about the data an attacker can access via GCP's API endpoints

First reported Oct 24, 2021 17:41 UTCOpen evidence record

REPORT1 SOURCE

Enumerate AWS Account ID from a Public S3 Bucket

Knowing only the name of a public S3 bucket, you can ascertain the account ID it resides in.

First reported Apr 03, 2021 01:39 UTCOpen evidence record

REPORT1 SOURCE

AWS Network Firewall Egress Filtering Bypass

Bypass AWS Network Firewall Egress Filtering using SNI spoofing and Host Header manipulation.

First reported Sep 28, 2025 20:45 UTCOpen evidence record

REPORT1 SOURCE

Loot Public EBS Snapshots

How to find and take advantage of exposed EBS snapshots.

First reported Dec 05, 2022 02:08 UTCOpen evidence record

REPORT1 SOURCE

Thunder CTF

GCP themed CTF

First reported Aug 29, 2022 00:18 UTCOpen evidence record

REPORT1 SOURCE

Enumerate AWS Account ID from an EC2 Instance

With access to an ec2 instance, you will be able to identify the AWS account it runs in.

First reported Feb 27, 2022 22:50 UTCOpen evidence record

REPORT1 SOURCE

Enumerate services via AWS Backup

Enumerate AWS services via AWS Backup

First reported May 06, 2025 06:06 UTCOpen evidence record

REPORT1 SOURCE

Using Stolen IAM Credentials

How to work with stolen IAM credentials and things to consider.

First reported May 14, 2022 21:51 UTCOpen evidence record

REPORT1 SOURCE

[Deprecated] Whoami - Get Principal Name From Keys

During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.

First reported Feb 09, 2022 04:00 UTCOpen evidence record

REPORT1 SOURCE

Brute Force IAM Permissions

Brute force the IAM permissions of a user or role to see what you have access to.

First reported Dec 20, 2020 18:58 UTCOpen evidence record

REPORT1 SOURCE

Enumerate Service Account Permissions

Brute force the permissions of a service account to see what you have access to.

First reported Aug 23, 2022 14:34 UTCOpen evidence record

REPORT1 SOURCE

Bypass GuardDuty Pentest Findings via Botocore Config

Override the default botocore user-agent string in boto3 to prevent GuardDuty PenTest findings from firing.

First reported Mar 24, 2026 00:24 UTCOpen evidence record

REPORT1 SOURCE

Default Account Information

Default information on how accounts and service accounts exist in GCP

First reported May 29, 2022 13:26 UTCOpen evidence record

REPORT1 SOURCE

Intercept SSM Communications

With access to an EC2 instance you can intercept, modify, and spoof SSM communications.

First reported Feb 06, 2021 17:17 UTCOpen evidence record

REPORT1 SOURCE

Survive Access Key Deletion with sts:GetFederationToken

Use sts:GetFederationToken to maintain access, even if the original IAM credentials are revoked.

First reported Sep 25, 2023 13:24 UTCOpen evidence record

REPORT1 SOURCE

AWS IAM Persistence Methods

A catalog of methods to maintain access to the AWS control plane.

First reported Aug 01, 2023 01:58 UTCOpen evidence record

REPORT1 SOURCE

IAM Persistence through Eventual Consistency

Abuse IAM's eventual consistency to maintain persistence against incident response containment.

First reported Dec 14, 2025 12:53 UTCOpen evidence record

REPORT1 SOURCE

Derive a Principal ARN from an AWS Unique Identifier

How to convert an unique identifier to a principal ARN.

First reported Nov 20, 2023 00:54 UTCOpen evidence record

REPORT1 SOURCE

Abusing Overpermissioned AWS Cognito Identity Pools

How to take advantage of misconfigured Amazon Cognito Identity Pools.

First reported Jun 20, 2023 17:26 UTCOpen evidence record

REPORT1 SOURCE

Get Account ID from AWS Access Keys

Techniques to enumerate the account ID associated with an AWS access key.

First reported Sep 27, 2020 16:06 UTCOpen evidence record

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.