Cloud persistence hunting¶

# generate a credential report (includes all users and their credential state)
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | column -t -s ','

# look for users with no console access but active access keys
# (common pattern for backdoor service accounts)
aws iam list-users --output json | python3 -c "
import json, sys
from datetime import datetime, timezone

users = json.load(sys.stdin)['Users']
for u in users:
    last_used = u.get('PasswordLastUsed', 'never')
    print(f\"{u['UserName']:40} created: {u['CreateDate']}  last_password: {last_used}\")
"

# check for recently attached policies (unusual privilege escalation)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AttachRolePolicy \
  --start-time "$(date -d '30 days ago' --iso-8601=seconds)" \
  --output json | python3 -c "
import json, sys
events = json.load(sys.stdin)['Events']
for e in events:
    detail = json.loads(e['CloudTrailEvent'])
    params = detail.get('requestParameters', {})
    print(e['EventTime'], e.get('Username','?'),
          params.get('roleName','?'), params.get('policyArn','?'))
"

# list all Lambda functions
aws lambda list-functions \
  --query 'Functions[*].[FunctionName,Runtime,LastModified,Role]' \
  --output table

# look for functions modified outside deployment windows
aws lambda list-functions --output json | python3 -c "
import json, sys
from datetime import datetime
funcs = json.load(sys.stdin)['Functions']
for f in funcs:
    print(f['LastModified'], f['FunctionName'], f['Runtime'])
" | sort

# review the execution role of any suspicious function
aws lambda get-function-configuration --function-name FUNCTION_NAME \
  --query '[Role, Environment.Variables]'

# list all parameters with their last-modified date
aws ssm describe-parameters \
  --query 'Parameters[*].[Name,LastModifiedDate,LastModifiedUser,Type]' \
  --output table | sort -k2

# check CloudTrail for PutParameter events
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=PutParameter \
  --start-time "$(date -d '7 days ago' --iso-8601=seconds)" \
  --query 'Events[*].[EventTime,Username,Resources[0].ResourceName]' \
  --output table

# check for buckets with public access
aws s3api list-buckets --query 'Buckets[*].Name' --output text |
  tr '\t' '\n' | while read bucket; do
    result=$(aws s3api get-bucket-acl --bucket "$bucket" \
      --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' \
      --output text 2>/dev/null)
    [[ -n "$result" ]] && echo "PUBLIC ACL: $bucket -- $result"
  done

# check CloudTrail for bucket policy changes
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=PutBucketPolicy \
  --start-time "$(date -d '30 days ago' --iso-8601=seconds)" \
  --output table

# list all function apps
az functionapp list --query '[*].[name,resourceGroup,state,lastModifiedTimeUtc]' -o table

# check for function apps with recently modified code
# (use deployment history rather than az cli for code content)
az functionapp deployment list-publishing-profiles --name FUNCNAME \
  --resource-group RG --query '[*].[publishMethod,lastModified]'

# list recent workflow file changes (git-based approach on the repo)
git log --all --name-only --format='%H %ae %ad' -- '.github/workflows/**'

# or via GitHub API: list recent commits, then inspect each diff individually
# (the commits list endpoint does not include file details)
gh api repos/ORG/REPO/commits \
  --jq '.[] | {sha: .sha, author: .commit.author.email, date: .commit.author.date, message: .commit.message}'

# show the diff of a specific workflow change
gh api repos/ORG/REPO/commits/COMMIT_SHA \
  --jq '.files[] | select(.filename | startswith(".github/workflows/")) | .patch'

# GitHub: list secrets and their last-updated date
gh api repos/ORG/REPO/actions/secrets \
  --jq '.secrets[] | {name: .name, updated_at: .updated_at}'

# check Actions audit log for secret access (requires org audit log API)
gh api orgs/ORG/audit-log \
  --paginate \
  --jq '.[] | select(.action | startswith("secret")) | {action, actor, repo, created_at}'