<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Lateral Movement Detection — API Reference

## AWS CloudTrail Queries

```bash
# Lookup events by name
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole \
  --max-results 50 --output json

# Lookup by user
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=USER \
  --output json

# Time-bounded lookup
aws cloudtrail lookup-events \
  --start-time "2026-01-01T00:00:00Z" --end-time "2026-01-02T00:00:00Z" \
  --output json

# Key event names for lateral movement
# AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity
# CreateAccessKey, GetSessionToken, GetFederationToken
# AttachRolePolicy, PutRolePolicy, UpdateAssumeRolePolicy
```

## CloudTrail Event Fields

| Field | Description |
|-------|-------------|
| `eventName` | API action name |
| `sourceIPAddress` | Caller IP |
| `userIdentity.type` | IAMUser, AssumedRole, Root, FederatedUser |
| `userIdentity.arn` | Caller ARN |
| `requestParameters.roleArn` | Target role for AssumeRole |
| `responseElements.credentials` | Temporary credentials returned |
| `errorCode` | AccessDenied, UnauthorizedAccess |

## EC2 Metadata Service

```bash
# Check IMDS version enforcement
aws ec2 describe-instances --output json | \
  jq '.Reservations[].Instances[] | {InstanceId, HttpTokens: .MetadataOptions.HttpTokens}'

# Enforce IMDSv2
aws ec2 modify-instance-metadata-options --instance-id ID \
  --http-tokens required --http-put-response-hop-limit 1

# IMDSv2 token request (from inside instance)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/
```

## VPC Flow Log Analysis

```bash
# CloudWatch Insights query for lateral movement
aws logs start-query \
  --log-group-name vpc-flow-logs \
  --start-time EPOCH_START --end-time EPOCH_END \
  --query-string 'fields srcAddr, dstAddr, dstPort, action | filter dstPort in [22, 3389, 5985] and action = "ACCEPT" | stats count(*) by srcAddr, dstAddr, dstPort | sort count desc'

# Get query results
aws logs get-query-results --query-id QUERY_ID
```

## Kubernetes Audit Events

```bash
# Pod exec events
kubectl get events -A --field-selector reason=ExecCreate -o json

# Service account token creation
# Filter audit logs for tokenRequest
cat audit.log | jq 'select(.verb == "create" and .objectRef.resource == "serviceaccounts")'

# Pod creation with host namespaces
cat audit.log | jq 'select(.verb == "create" and .objectRef.resource == "pods" and (.requestObject.spec.hostNetwork == true or .requestObject.spec.hostPID == true))'
```

## GuardDuty Finding Types (Lateral Movement)

| Finding Type | Description |
|-------------|-------------|
| `UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration` | Instance creds used from external IP |
| `Discovery:S3/MaliciousIPCaller` | S3 API from known malicious IP |
| `UnauthorizedAccess:EC2/RDPBruteForce` | RDP brute force |
| `Recon:EC2/PortProbeUnprotectedPort` | Port scanning |
