T1648

[ryananicholson]

Details:

Created a new attack for T1648 for AWS. The process that is mimicked is:

• Attacker has access to credentials with lambda:UpdateFunctionCode and lambda:InvokeFunction rights or the equivalent
• Function has an overly-permissive IAM role
• Function code is altered to create a backdoor IAM user account

Testing:

Executed the atomic test with the following command:

Invoke-AtomicTest -AtomicTechnique T1648 -InputArgs @{profile="default"; region="us-east-2"} -PathToAtomicsFolder ./atomics

To cleanup, I ran the following:

Invoke-AtomicTest -AtomicTechnique T1648 -InputArgs @{profile="default"; region="us-east-2"} -PathToAtomicsFolder ./atomics -Cleanup

Associated Issues:

No issues corrected with this PR.

[ryananicholson]

Please remove this PR... VSCode is fighting me and adding unrelated content. Will start again with a fresh PR