Understanding, Abusing and Monitoring AWS AppStream 2.0

Rodrigo Montoro presents research on AWS AppStream 2.0, a managed service that streams desktop applications to users from inside a customer's VPC. The talk starts with the motivation: an incident response case in which an attacker used an AppStream instance attached to an administrator role, and the speaker realised that the monitoring in place would likely not have caught it. Lightly watched AWS services like this one often fall outside detection coverage, even when they sit inside the same network as the core workloads.

The middle of the talk walks through an attack path built from the speaker's proof of concept. It starts with read-only enumeration of roles, subnets, security groups and existing image builders, then covers ways to reach a privileged session: generating a streaming URL for a running image builder, starting a stopped one, or creating a new image builder with a chosen role. The speaker also describes sharing a malicious image to another account through image permission updates, and notes that a streaming URL opens a browser session on a machine that carries role credentials, with no extra authentication step.

For defenders, the talk focuses on CloudTrail events such as CreateImageBuilder, StartImageBuilder, CreateStreamingURL and UpdateImagePermissions. Suggested detections include alerts on role passing to AppStream roles, use of unexpected subnets or security groups, image sharing outside an approved account list, and newly created users with non-corporate email addresses. The closing advice covers restricting services with SCPs, removing unused image builders, adding source IP conditions, and sharing detection content such as Sigma rules.