CyberStrike’s AWS toolkit isn’t a compliance dashboard that tells you something might be wrong. Awshook is 173 deterministic programs that walk the full MITRE ATT&CK kill chain against an AWS account, from initial recon to credential harvesting, privilege escalation, persistence, lateral movement, evasion, exfiltration, and impact assessment, all through the AWS CLI and REST APIs. The same operations a real attacker would run, structured as tooling an AI agent can drive.
What it covers
173 programs across 10 categories:
| Category | # | Highlights |
|---|---|---|
| Recon | 54 | IAM, EC2, S3, Lambda, VPC, RDS, ECS, EKS, SSO, Organizations, Route 53, CloudFormation, API Gateway, SNS/SQS, CloudWatch, ElastiCache, Redshift, KMS, OpenSearch, EFS, ELB, DynamoDB, Cognito, STS, Secrets Manager, SSM, SageMaker, Step Functions, Glue, CodePipeline, EventBridge, WAF, CloudTrail, Config, GuardDuty, Security Hub, Inspector, Backup, Athena, EMR, MSK, ECR, App Runner, Amplify, ACM, Transfer Family, public exposure, stale permissions, tag compliance, public EBS/RDS snapshots, cross-service policy audit |
| Credential | 14 | IMDS/IMDSv2 metadata harvest, Secrets Manager + SSM dump, access key enum, role assumption, federation token, ECR token, Cognito token, CloudFormation secret extraction, CodeCommit creds, CI/CD secret extraction, EC2 user-data harvest, Lambda env harvest, SSM parameter mining |
| Privilege escalation | 11 | IAM privesc (PassRole, AssumeRole, AttachPolicy), policy version rollback, role chaining, Lambda/Glue/CloudFormation/SSM/EC2 privesc, permission boundary bypass, SageMaker privesc, auto_privesc_scan (21 Rhino Security vectors via simulate-principal-policy) |
| Persistence | 11 | Lambda/IAM/EventBridge/SSM/CodeBuild backdoors, AMI backdoor, cross-account role, Cognito backdoor, EC2 Instance Connect, SSM State Manager, ECS scheduled task |
| Lateral movement | 10 | SSM RunCommand/Session, ECS Exec, cross-account enum, VPC peering, Transit Gateway, Lightsail, Lambda invocation, EKS lateral, Lambda VPC pivot |
| Defense evasion | 13 | CloudTrail blind + selector tamper, GuardDuty evade, Config disable, VPC flow disable, Access Analyzer suppress, Security Hub suppress, WAF bypass, DNS Firewall disable, CloudWatch tamper, Macie disable, Inspector disable, S3 logging disable |
| Exfiltration | 18 | S3/RDS/DynamoDB dump, EBS snapshot + direct read, S3 cross-account exfil, data staging, CodeCommit dump, ECR dump, Athena query, secrets bulk export, Backup vault enum, CloudWatch logs dump, SNS/SQS siphon, Kinesis tap, S3 version recovery, S3 replication exfil, cleanup |
| Compliance | 18 | CIS Foundations benchmark, access key rotation, MFA audit, password policy, root account, encryption-at-rest, public access, logging, network segmentation, data classification, backup compliance, IAM best practices, VPC flow logs, S3/RDS public audit, secret rotation, service quotas, account security |
| Identity | 14 | Deep IAM audit, Cognito security, Organization SCPs, password spray, identity summary, role trust audit (confused deputy), service-linked roles, access-last-used, identity provider (SAML/OIDC), SSO permission audit, STS sessions, group membership, permission boundaries, IAM policy simulation |
| Impact | 10 | Resource hijack, ransomware sim, resource deletion capability, service disruption, data destruction paths, account lockout risk, crypto mining exposure, billing impact, DNS hijack, network disruption |
How it works
Same model as azurehook: one tool call, one program. An agent calls awshook with a program name (s3_enum, auto_privesc_scan, role_trust_audit) and gets back structured findings with severity, CWE mapping, and evidence. Every finding carries an ID like AWS-PRIVESC-AUTO-001 mapped to a CWE. All calls go through the AWS CLI, no Python SDK, no boto3.
The recommended flow: start with recon programs to map the account, then auto_privesc_scan to find privilege escalation paths, then follow the kill chain based on what the recon surfaced.
What makes it different from azurehook
Awshook is broader: AWS has more services, so there are more recon targets (54 vs Azure’s 47). The evasion category is deeper (13 programs vs 11) because AWS has more logging and detection surfaces to manipulate: CloudTrail, GuardDuty, Config, Security Hub, Access Analyzer, Inspector, Macie, VPC Flow Logs, DNS Firewall. The impact category is also richer (10 vs 5) with dedicated programs for crypto mining exposure, billing impact, DNS hijack, and network disruption: real-world post-compromise scenarios that go beyond generic “data destruction.”
The standout program is auto_privesc_scan: an automated Pacu-style scanner that simulates 21 Rhino Security privilege escalation vectors via simulate-principal-policy, then cross-references assumable high-privilege roles. No manual path-building: it maps the graph.
CIS compliance
329 CIS benchmark skills across five AWS domains: Foundations, Compute Services, Database Services, End User Compute, and Storage Services. These ship as SKILL.md playbooks the agents invoke during compliance checks.
Safety
Cleanup is enforced: cleanup_aws removes all CyberStrike-created resources (IAM users, Lambda functions, snapshots, stacks, EventBridge rules) and restores CloudTrail logging. Agents are instructed to always run it before leaving a target.
Part of the @cyberstrike-io/aws package. Auth: AWS CLI configured credentials. For the Azure equivalent, see Azurehook: 154 programs for Azure offense.
