search

DataDog / grimoire

Generate datasets of cloud audit logs for common attacks
https://securitylabs.datadoghq.com/articles/announcing-grimoire/
Apache License 2.0
185 stars 14 forks source link

Fix edge case when Ctrl+C is run during detonation #6

Open christophetd opened 3 months ago

christophetd commented 3 months ago 
WARN[2024-08-03 23:49:49] You have %d events in the exclude list0
INFO[2024-08-03 23:49:49] Warming up Stratus Red Team attack technique aws.persistence.iam-create-admin-user
INFO[2024-08-03 23:49:49] Detonating Stratus Red Team attack technique aws.persistence.iam-create-admin-user
^CINFO[2024-08-03 23:49:51] Exiting Grimoire cleanly, don't press Ctrl+C again
INFO[2024-08-03 23:49:51] You pressed Ctrl+C during the Stratus Red Team detonation, which could leave some cloud resources in your account. Attempting to clean it up...
DEBU[2024-08-03 23:49:51] Clean-up routine completed
DEBU[2024-08-03 23:49:51] Cleanup finished, exiting
Error: unable to detonate Stratus Red Team attack technique aws.persistence.iam-create-admin-user: context canceled
exit status 1
christophetd commented 3 months ago

Here technique is COLD but has been "partially" detonated. Might want to handle that at the Stratus level?