The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions for executing remote scripts via shell piping (e.g., curl ... | bash). These patterns are found in both plain text and Base64-encoded payloads intended for EC2 UserData and SSM associations.
[REMOTE_CODE_EXECUTION]: Methodology includes deploying malicious Lambda Layers and Extensions to execute arbitrary Python or Bash code during function initialization, specifically for stealing runtime credentials.
[DATA_EXFILTRATION]: Provides extensive documentation on exfiltrating sensitive data from AWS S3, RDS, EBS, and DynamoDB. This includes techniques like cross-account snapshot sharing and direct block-level reading of disk volumes.
[DATA_EXFILTRATION]: Includes instructions for exfiltrating data via DNS TXT queries to bypass network-level egress restrictions.
[COMMAND_EXECUTION]: Instructs the agent on how to disable or manipulate AWS security services, including stopping CloudTrail logging, deleting trails, and modifying GuardDuty detector settings to hide malicious activity.
[CREDENTIALS_UNSAFE]: Provides commands to batch-extract secrets from AWS Secrets Manager and SSM Parameter Store, as well as harvesting credentials from Lambda environment variables.
[CREDENTIALS_UNSAFE]: Instructions include accessing and using private SSH keys (~/.ssh/id_rsa.pub) and modifying IAM trust policies to allow unauthorized cross-account access.

aws-post-exploit