hotnops

<?xml version="1.0" encoding="utf-8"?>
<SyncRules>
    <synchronizationRule>
        <id>{64304b7a-1bb1-4347-bec4-bfe30ba77174}</id>
        <internal-id>{64304b7a-1bb1-4347-bec4-bfe30ba77174}</internal-id>
        <version>1</version>
        <name>In from AAD - User Join</name>
        <description />
        <immutable-tag>Microsoft.InfromAADUserJoin.005</immutable-tag>
        <direction>Inbound</direction>

hotnops

// Find cognito vulenerable roles as specified in https://securitylabs.datadoghq.com/articles/amplified-exposure-how-aws-flaws-made-amplify-iam-roles-vulnerable-to-takeover/
MATCH p=(r:AWSRole) <- [:AttachedTo] - (a:AWSAssumeRolePolicy) <- [:AttachedTo] - (s:AWSStatement {effect: "Allow"}) - [:Principal] -> (prin)
WHERE prin.name CONTAINS "cognito"
WITH s, p, r
OPTIONAL MATCH p2=(s) <- [:AttachedTo] - (c:AWSCondition) <- [:AttachedTo] - (ck:AWSConditionKey)
WHERE ck.name = "cognito-identity.amazonaws.com:aud"
WITH p, p2, s,r, COLLECT(ck) AS matchedKeys
WHERE SIZE(matchedKeys) = 0
RETURN r.arn

hotnops

import java.io.DataOutputStream;
import java.net.HttpURLConnection;
import java.net.URL;

sub oplog::saveToDisk {
	local('$timestamp $localIP $destIP $userContext $command $operator $oplog_id $logfile $data $header $handle $error');
	$timestamp = $1;
	$localIP = $2;
	$destIP = $3;
	$userContext = $4;

hotnops

Keybase proof

I hereby claim:

• I am hotnops on github.
• I am hotnops (https://keybase.io/hotnops) on keybase.
• I have a public key ASBkwHOmbmapDUoTZGkExGpiJiHJhQG5ULt_HR1zZtHM-Qo

To claim this, I am signing this object: