🔶 Investigating Persistence Mechanisms in AWS

Rapid7 Labs details four AWS persistence techniques used by attackers: rogue IAM user creation, backdoored assume role policies granting external account access, malicious Lambda functions provisioning privileged users, and federated user sessions that survive key rotation. Includes LEQL detection queries and remediation steps.

https://www.rapid7.com/blog/post/dr-investigating-aws-persistence-mechanisms

#aws