rule P0_Hunting_AWS_EnvVarNames_1 {
	meta:
		description = "Detecting presence of scripts searching for numerous environment variables containing sensitive AWS credential information. Explicitly excluding LinPEAS (and its variants) to remove noise since it is already well-detected."
		author = "daniel.bohannon@permiso.io (@danielhbohannon)"
		date = "2023-07-12"
		reference = "https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/"
		md5_01 = "3e2cddf76334529a14076c3659a68d92"
		md5_02 = "b9113ccc0856e5d44bab8d3374362a06"
		md5_03 = "d9ecceda32f6fa8a7720e1bf9425374f"
		md5_04 = "28165d28693ca807fb3d4568624c5ba9"
		md5_05 = "0855b8697c6ebc88591d15b954bcd15a"
		md5_06 = "f7df739f865448ac82da01b3b1a97041"
		md5_07 = "1a37f2ef14db460e5723f3c0b7a14d23"
		md5_08 = "99f0102d673423c920af1abc22f66d4e"
		md5_09 = "99f0102d673423c920af1abc22f66d4e"
		md5_10 = "5daace86b5e947e8b87d8a00a11bc3c5"
	strings:
		$shellHeader_01 = "#!/bin/sh"
		$shellHeader_02 = "#!/bin/bash"
		$envVarAWSPrefixSyntax_01 = " $AWS_ "
		$envVarAWSPrefixSyntax_02 = " ${AWS_"
		$envVarAWS_01 = "AWS_ACCESS_KEY_ID"
		$envVarAWS_02 = "AWS_SECRET_ACCESS_KEY"
		$envVarAWS_03 = "AWS_SESSION_TOKEN"
		$envVarAWS_04 = "AWS_SHARED_CREDENTIALS_FILE"
		$envVarAWS_05 = "AWS_CONFIG_FILE"
		$envVarAWS_06 = "AWS_DEFAULT_REGION"
		$envVarAWS_07 = "AWS_REGION"
		$envVarAWS_08 = "AWS_EC2_METADATA_DISABLED"
		$envVarEcho = "then echo "
		$linPEAS_01 = "#-------) Checks pre-everything (---------#"
		$linPEAS_02 = "--) FAST - Do not check 1min of procceses and su brute"
	condition:
		(any of ($shellHeader*)) and (1 of ($envVarAWSPrefixSyntax*)) and (4 of ($envVarAWS*)) and (#envVarEcho >= 4) and not (all of ($linPEAS*))
}