Update T1580.yaml AWS - EC2 Security Group Enumeration

[prashanthpulisetti]

Simulate Attacker Action for Enumerating EC2 Security Groups

Details

This update introduces an Atomic Test designed to simulate an attacker's actions in enumerating EC2 Security Groups within a compromised AWS environment. The test leverages the AWS CLI to query and list all security groups, revealing details like group IDs, names, and associated rules. This simulation helps in understanding potential reconnaissance steps an attacker might take after gaining initial access to AWS resources.

Implementation

• The test uses the aws ec2 describe-security-groups command.
• Input parameters include the AWS profile (aws_profile) and the desired output format (output_format).
• This atomic test is compatible with Linux, macOS, Windows, and AWS as an IaaS platform.
• Prerequisites include the installation and configuration of the AWS CLI, with appropriate permissions to access EC2 Security Group information.

Testing

• The test was executed in a controlled AWS environment using different profiles with varying permission levels to ensure accurate response based on IAM roles.
• Tested on various platforms including Linux, macOS, and Windows to ensure compatibility and correct execution of commands.
• Validation checks were performed to ensure no configuration changes are made in the AWS environment, confirming the test's read-only nature.

Associated Issues

• There are no known issues associated with this test. However, users should be aware that running this test in a production environment can potentially reveal sensitive security configuration details. It's recommended to execute this in a test or sandbox AWS environment.
• Care should be taken with the AWS CLI profile used, as profiles with extensive permissions might inadvertently expose more information than intended.

[patel-bhavin]

The PR is updated based on @cyberbuff 's comments ! thank you for the atomic @prashanthpulisetti

[prashanthpulisetti]

@patel-bhavin can you confirm if this PR is still open? or can be closed?

[patel-bhavin]

Yes, the PR is good! Thanks for contributing this test !