Terrance DeJesus terrancedejesus

## tycoon2fa_aitm_containment.yaml
name: Tycoon2FA AiTM Containment (M365, live)
description: |
  Triggers on alerts from the "Successful Sign-in from Known AiTM Kit Egress ASN" rule.
  Wire this workflow as the rule's "Run Workflow" action; the rule binding handles the rule-id filter.
  Runs the documented Response chain against real Microsoft Graph using a client_credentials bearer
  acquired at trigger time. Assumes every alert from the wired rule is an Entra sign-in.

  Credentials are inlined for demo simplicity. Rotate or delete the app registration after the demo.

triggers:

## iac_white_box_aws_sns_exfiltration_main.tf
provider "aws" {
  region = var.region
}

# Generate random ID for unique resource names
resource "random_id" "unique" {
  byte_length = 2
}

# VPC for EC2

## customer_data.csv

          
            CustomerID
            Name
            Email
            TotalSpent

            
              1
              John Doe
              johndoe@example.com
              $5000

            
              2
              Jane Smith
              janesmith@example.com
              $3000

            
              3
              Bob Johnson
              bobjohnson@example.com
              $7000

## gcp_service_account_access_key_emulation.sh
#!/bin/bash

# Exit immediately if a command exits with a non-zero status.
set -e

# Variables (replace with your project ID)
PROJECT_ID="<your-project-id>"
SERVICE_ACCOUNT_NAME="attacker-sa"
SERVICE_ACCOUNT_DISPLAY_NAME="Attacker Service Account"
KEY_FILE="attacker-sa-key.json"

## aws_ec2_describe_instance_for_all_regions.sh
#!/bin/bash

# Assumes existing AWS CLI authentication
# Disable AWS CLI pager
export AWS_PAGER=""

# Output file
output_file="ec2_service_quotas.log"
echo "EC2 Service Quotas Check - $(date)" > "$output_file"
echo "===================================" >> "$output_file"

## aws_temp_creds_console_login_emulate.sh
#!/bin/bash

# Get federated creds
output=$(aws sts get-federation-token --name consoler --policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess)

# Check if the previous command was successful
if [ $? -ne 0 ]; then
    echo "The command 'aws sts get-federation-token --name consoler' failed."
    exit 1
fi

## aws_s3_bucket_object_setup_and_retrieval.sh
#!/bin/bash

# Disable AWS CLI pager
export AWS_PAGER=""

# Define variables
bucket_name="test-vulnerable-access-bucket-$(date +%s)"
access_log_bucket_name="${bucket_name}-logs"
region="us-east-1"  # Update if in a different region
object_prefix="sensitive-file"

## aws_administratoraccess_attached_emulation.sh
#!/bin/bash

# Disable AWS CLI pager
export AWS_PAGER=""

# Define the user and role names
user_name="test-user"
role_name="test-role"

# Create a new IAM user

## elastic_aws_threat_detection_setup.sh
#!/bin/bash

# Replace with your own values
RANDOM_SUFFIX=$(openssl rand -hex 4)
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION="us-west-2"
IAM_USER="elastic_agent"
S3_BUCKET="elastic-monitoring-logs-$RANDOM_SUFFIX"
CLOUDTRAIL_NAME="elastic-trail"
SQS_QUEUE_NAME="elastic-monitoring-queue"

## main.tf
provider "aws" {
  region = var.region
}

data "aws_caller_identity" "current" {}

resource "random_id" "bucket_suffix" {
  byte_length = 4
}
	name: Tycoon2FA AiTM Containment (M365, live)
	description: \|
	Triggers on alerts from the "Successful Sign-in from Known AiTM Kit Egress ASN" rule.
	Wire this workflow as the rule's "Run Workflow" action; the rule binding handles the rule-id filter.
	Runs the documented Response chain against real Microsoft Graph using a client_credentials bearer
	acquired at trigger time. Assumes every alert from the wired rule is an Entra sign-in.

	Credentials are inlined for demo simplicity. Rotate or delete the app registration after the demo.

	triggers:
	provider "aws" {
	region = var.region
	}

	# Generate random ID for unique resource names
	resource "random_id" "unique" {
	byte_length = 2
	}

	# VPC for EC2
CustomerID	Name	Email	TotalSpent
1	John Doe	johndoe@example.com	$5000
2	Jane Smith	janesmith@example.com	$3000
3	Bob Johnson	bobjohnson@example.com	$7000
	#!/bin/bash

	# Exit immediately if a command exits with a non-zero status.
	set -e

	# Variables (replace with your project ID)
	PROJECT_ID="<your-project-id>"
	SERVICE_ACCOUNT_NAME="attacker-sa"
	SERVICE_ACCOUNT_DISPLAY_NAME="Attacker Service Account"
	KEY_FILE="attacker-sa-key.json"
	#!/bin/bash

	# Assumes existing AWS CLI authentication
	# Disable AWS CLI pager
	export AWS_PAGER=""

	# Output file
	output_file="ec2_service_quotas.log"
	echo "EC2 Service Quotas Check - $(date)" > "$output_file"
	echo "===================================" >> "$output_file"
	#!/bin/bash

	# Get federated creds
	output=$(aws sts get-federation-token --name consoler --policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess)

	# Check if the previous command was successful
	if [ $? -ne 0 ]; then
	echo "The command 'aws sts get-federation-token --name consoler' failed."
	exit 1
	fi
	#!/bin/bash

	# Replace with your own values
	RANDOM_SUFFIX=$(openssl rand -hex 4)
	ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
	REGION="us-west-2"
	IAM_USER="elastic_agent"
	S3_BUCKET="elastic-monitoring-logs-$RANDOM_SUFFIX"
	CLOUDTRAIL_NAME="elastic-trail"
	SQS_QUEUE_NAME="elastic-monitoring-queue"
	provider "aws" {
	region = var.region
	}

	data "aws_caller_identity" "current" {}

	resource "random_id" "bucket_suffix" {
	byte_length = 4
	}