REPORT1 SOURCE
Run Command Abuse
Utilise Azure RunCommands for execution and lateral movement.
First reported Oct 05, 2024 05:04 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations, indicators, and research history in one bounded catalog.
94Reachable catalog records
4 / 4Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_0fd74b59b2db565a4cCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
94 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE
Enumerate Org/Folder/Project Permissions + Individual Resource Permissions
Brute force the permissions of all resources above to see what permissions you have. Includes example of brute forcing ~9500 permissions at the end. Also introduces tool that passively collections permissions allowed as run (gcpwn)
First reported Jul 14, 2024 21:08 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Introduction to User Data
An introduction to EC2 User Data and how to access it.
First reported Dec 20, 2020 20:10 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
DNS and CloudFront Domain Takeover via Deleted S3 Buckets
How orphaned Route53 records and CloudFront distributions can be taken over if the backing S3 bucket is deleted.
First reported Dec 20, 2023 14:50 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
AWS API Call Hijacking via ACM-PCA
By modifying the route53 entries and utilizing the acm-pca private CA one can hijack the calls to AWS API inside the AWS VPC
First reported Mar 13, 2022 23:45 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Exploiting Public AWS Resources Programmatically - The Playbook
A playbook on how to exploit AWS resources that can be misconfigured via resource-based policies.
First reported Dec 05, 2024 17:37 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Steal IAM Credentials and Event Data from Lambda
Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.
First reported Aug 12, 2020 23:15 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Abusing Misconfigured ECR Resource Policies
How to take advantage of misconfigured AWS ECR private repositories.
First reported Nov 24, 2022 22:14 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
AWS CLI Tips and Tricks
A collection of tips and tricks for using the AWS CLI.
First reported Nov 04, 2024 03:15 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Abusing Misconfigured Role Trust Policies with a Wildcard Principal
How to take advantage of misconfigured role trust policies that have wildcard principals.
First reported Jan 29, 2024 03:39 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Exploiting Misconfigured Terraform Cloud OIDC AWS IAM Roles
Discover how to identify and exploit misconfigured AWS IAM roles using Terraform Cloud OIDC
First reported Dec 13, 2024 12:28 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Abusing Managed Identities
Abusing Managed Identities
First reported Mar 27, 2022 16:57 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Detect Public Resource Exposure via Session Policy Error Messages
Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.
First reported Mar 15, 2026 13:50 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Whoami - Get Principal Name From Keys
During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.
First reported Aug 21, 2020 17:00 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
2024 Cloud Security Highlights: Hacking the Cloud’s Year in Review
An end of year summary for Hacking the Cloud in 2024.
First reported Dec 23, 2024 00:48 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
IAM Roles Anywhere Persistence
Abusing IAM Roles Anywhere to obtain persistent AWS access from outside the cloud.
First reported Sep 21, 2025 15:49 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Run Shell Commands on EC2 with Send Command or Session Manager
Leverage privileged access in an AWS account to run arbitrary commands on an EC2 instance.
First reported Apr 11, 2022 23:11 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
AWS IAM Privilege Escalation Techniques
Common techniques that can be leveraged to escalate privileges in an AWS account.
First reported Nov 04, 2021 21:03 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Unauthenticated Enumeration of Azure Active Directory Email Addresses
Discover how to exploit information disclosure configurations in Azure Active Directory to enumerate valid email addresses.
First reported Apr 11, 2023 13:31 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Steal EC2 Metadata Credentials via SSRF
Old faithful; How to steal IAM Role credentials from the EC2 Metadata service via SSRF.
First reported Aug 01, 2020 17:43 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Download Tools and Exfiltrate Data with the AWS CLI
Using the AWS CLI as a LOLScript to download and exfiltrate data.
First reported Jul 13, 2023 03:46 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Abusing Unintended Self-Signup in AWS Cognito
How to take advantage of misconfigured Amazon Cognito User Pools.
First reported Jun 20, 2023 17:26 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.