Now Reading
Leonidas: Automated cloud attack simulation

Leonidas: Automated cloud attack simulation

Leonidas is a framework for performing cloud attacks. Provides a YAML-based format for defining cloud intruder tactics, techniques and procedures (TTPs) and related detection properties. These definitions can then be grouped into:

architecture - Leonidas: Automated cloud attack simulation

Generator Locally Installation

  • cd generator
  • poetry install

Generating Sigma Rules

  • poetry run ./generator.py sigma

The rules appear in ./output/sigma

Generating Documentation

The documentation is created as follows:
  • poetry run ./generator.py docs
This will generate markdown versions, which are available in output / docs. This can be downloaded to an existing markdown-based system, or the following can be used to create a predefined version of HTML documents:
  • cd output
  • mkdocs build
This will create an output / site folder that contains the HTML site. It is also possible to view it locally by running mkdocs serve services in the same folder.

Writing Definitions

The definitions are written in YAML format, for which an example is provided below. Documentation on how to write them can be found in Writing Definitions.
name: Enumerate Cloudtrails for a Given Region author: Nick Jones 

Description: | An adversary may attempt to enumerate the configured trails, to identify what actions will be logged and where they will be logged to. In AWS, this may start with a single call to enumerate the trails applicable to the default region. 

category: Discovery mitre_ids: - T1526 

platform: aws 

permissions: - cloudtrail:DescribeTrails 
input_arguments: executors: sh: queues: | aws cloudtrail describe-trails leonidas_aws: implemented: True clients: - cloudtrail code: | result = customers[cloudtrail].describe_trails() 

detection: sigma_id: 48653a63-085a-4a3b-88be-9680e9adb449 status: experimental 

level: low sources: - name: cloudtrail 

attributes: eventName: "DescribeTrails" 
eventSource: "* .cloudtrail.amazonaws.com"

You can download the program from here.

Read them Technology News from all over the world, with the validity of iGuRu.gr

Follow us on Google News

View Comments (0)

Leave a Reply

Your email address Will not be published.


iGuRu.gr © 2012 - 2021 Keep it Simple Stupid Custom Theme

Scroll To Top