DETECTION OVERVIEW

Cloud Credential Enumeration Activity

Risk Factors

Enumeration of cloud credentials is an important step taken by attackers to extend their access from a local network into cloud environments. Automated tools such as Seatbelt and SharpCloud make enumeration easy to perform after an attacker gains network access. If an attacker successfully extracts sensitive files, they can bypass traditional perimeter defenses and directly compromise your cloud infrastructure.

Background

Seatbelt and SharpCloud are tools for running security checks on local and remote Windows devices, but they can also enumerate valuable information for an attacker. Cloud providers such as AWS, Azure, and Google Cloud offer Command-Line Interfaces (CLI) to manage cloud-based infrastructure. These CLIs store API keys and other authentication credentials within their local configuration files, typically in plain text. Attackers run these tools to locate sensitive configuration files by sending a series of SMB requests to the target device. The target device responds with CIFS CREATE responses, which indicate whether the requested files exist for the attacker to read. After an attacker acquires these credentials, they can authenticate directly to the cloud provider as a legitimate user.

Mitigation Options

Configure your CLI to store credentials in a custom directory or protected drive rather than the default path

Cloud Credential Enumeration Activity

Background

Mitigation Options

MITRE ATT&CK ID

What else can RevealX do for you?