---
title: Qubole Cross-Account Role Assumption Anomaly
id: 8f4e2a1b-3c5d-4e6f-9a8b-1c2d3e4f5a6b
status: experimental
description: Detects suspicious cross-account IAM role assumption originating from non-Qubole IP addresses, indicating potential abuse of vendor trust relationships
author: Security Arsenal Threat Intelligence
references:
    - https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild
date: 2026/11/10
modified: 2026/11/10
tags:
    - attack.t1078.004
    - attack.t1552.005
    - attack.t1199
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: sts.amazonaws.com
        eventName: AssumeRole
        requestParameters.roleSessionName|contains: 'qubole'
    filter_qubole_ips:
        sourceIPAddress|cidr:
            - '52.0.0.0/8'  # Example Qubole range - update with actual ranges
            - '54.0.0.0/8'
    filter_internal:
        sourceIPAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not (filter_qubole_ips or filter_internal)
falsepositives:
    - Legitimate Qubole operations from new IP ranges
    - Internal testing of vendor integrations
level: high
---
title: TruffleHog Execution in AWS Environment
id: 9a5f3b2c-4d6e-5f7a-0b1c-2d3e4f5a6b7c
status: experimental
description: Identifies execution of TruffleHog secret scanning tool, which may indicate credential harvesting activity when executed outside of approved security testing
author: Security Arsenal Threat Intelligence
date: 2026/11/10
modified: 2026/11/10
tags:
    - attack.t1552.001
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\trufflehog.exe'
            - '\trufflehog'
    selection_cmd:
        CommandLine|contains:
            - 'trufflehog'
            - '--entropy'
            - '--regex'
    filter_security_team:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        User|contains: 'SECURITY_TEST'
    condition: (selection_img or selection_cmd) and not filter_security_team
falsepositives:
    - Legitimate security team scanning activities
    - DevOps pipeline secret scanning
level: medium
---
title: S3 Bucket Enumeration via Cross-Account Access
id: 0b6c4d3e-5f7a-6b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects rapid enumeration of S3 buckets and objects potentially indicating reconnaissance for data exfiltration following cross-account compromise
author: Security Arsenal Threat Intelligence
date: 2026/11/10
modified: 2026/11/10
tags:
    - attack.t1530
    - attack.t1074
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: s3.amazonaws.com
        eventName:
            - ListBuckets
            - ListObjects
            - GetBucketLocation
            - GetBucketPolicy
    timeframe: 5m
    condition: selection | count() by sourceIPAddress > 20
falsepositives:
    - Legitimate backup operations
    - Data migration activities
    - Inventory management tools
level: medium

// Hunt for Qubole cross-account access and credential harvesting activities
// Execute in Microsoft Sentinel or Defender ATP

let QuboleIOC = dynamic(["45.83.220.211", "57.129.54.120", "185.209.199.73", "89.37.63.175"]);
let TruffleHogHashes = dynamic(["086d4a83181971e883c53a4c44f46da2", "1c7437dac21630f53c0b888b50662c6487e23fd7", "65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4"]);

// Check for network connections to suspicious IPs
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (QuboleIOC)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | project DeviceName, ProcessId, FileName, CommandLine, InitiatingProcessFileName
) on DeviceName, InitiatingProcessFileName
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Connections = count() by DeviceName, RemoteIP, FileName, CommandLine
| order by Connections desc;

// Check for TruffleHog execution
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName contains "trufflehog" or CommandLine contains "trufflehog"
| project TimeGenerated, DeviceName, FileName, CommandLine, InitiatingProcessFileName, AccountName),
(DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FileName contains "trufflehog"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName)
| summarize FirstExecution = min(TimeGenerated) by DeviceName, FileName, CommandLine;

// AWS CloudTrail analysis for anomalous AssumeRole events
AWSCloudTrail
| where TimeGenerated > ago(30d)
| where EventSource == "sts.amazonaws.com"
| where EventName == "AssumeRole"
| where SourceIpAddress in (QuboleIOC) or SourceIpAddress !startswith "52." // Filter out known Qubole ranges
| extend RoleArn = tostring(parse_json(RequestParameters).roleArn)
| extend SessionName = tostring(parse_json(RequestParameters).roleSessionName)
| where SessionName contains "qubole" or RoleArn contains "qubole"
| project TimeGenerated, SourceIpAddress, RoleArn, SessionName, UserIdentityPrincipalId, UserIdentityArn
| summarize RoleAssumptions = count() by SourceIpAddress, RoleArn
| order by RoleAssumptions desc;

# Qubole Compromise Hunt Script
# Run on endpoints and AWS CloudTrail logs to identify artifacts of Qubole cross-account abuse
# Requires: AWS CLI, appropriate IAM permissions

$ErrorActionPreference = "SilentlyContinue"
$Date = Get-Date -Format "yyyy-MM-dd"
$ReportPath = "C:\Security\Qubole_Hunt_Report_$Date.txt"

# Known malicious IPs from OTX pulse
$MaliciousIPs = @(
    "45.83.220.211",
    "57.129.54.120",
    "185.209.199.73",
    "89.37.63.175"
)

# TruffleHog indicators
$TruffleHogHashes = @(
    "086d4a83181971e883c53a4c44f46da2",
    "1c7437dac21630f53c0b888b50662c6487e23fd7",
    "65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4"
)

function Write-Log {
    param($Message)
    $LogEntry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
    Add-Content -Path $ReportPath -Value $LogEntry
    Write-Host $LogEntry
}

Write-Log "=== Qubole Cross-Account Compromise Hunt Started ==="

# Check 1: Network connections to malicious IPs
Write-Log "`n[+] Checking network connections to suspicious IPs..."
$Connections = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $MaliciousIPs }
if ($Connections) {
    Write-Log "[!] ALERT: Found connections to malicious IPs:"
    $Connections | ForEach-Object {
        Write-Log "    - $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)]"
    }
} else {
    Write-Log "    No active connections to malicious IPs detected"
}

# Check 2: DNS cache for malicious IPs
Write-Log "`n[+] Checking DNS cache for malicious IP resolution..."
$DNSCache = Get-DnsClientCache | Where-Object { $_.Data -in $MaliciousIPs }
if ($DNSCache) {
    Write-Log "[!] Found DNS cache entries:"
    $DNSCache | ForEach-Object { Write-Log "    - $($_.Name) -> $($_.Data)" }
}

# Check 3: TruffleHog execution artifacts
Write-Log "`n[+] Searching for TruffleHog binaries..."
$SearchPaths = @("C:\Users", "C:\ProgramData", "C:\Windows\Temp", $env:TEMP)
foreach ($Path in $SearchPaths) {
    $Files = Get-ChildItem -Path $Path -Recurse -Filter "*trufflehog*" -ErrorAction SilentlyContinue | Select-Object -First 10
    if ($Files) {
        Write-Log "[!] Found suspicious files:"
        $Files | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            $Match = if ($TruffleHogHashes -contains $Hash) { " [KNOWN MALICIOUS]" } else { "" }
            Write-Log "    - $($_.FullName)$Match"
        }
    }
}

# Check 4: Recent AWS credential usage
Write-Log "`n[+] Checking AWS CLI credential files..."
$AWSCredsPath = "$env:USERPROFILE\.aws\credentials"
if (Test-Path $AWSCredsPath) {
    $CredsContent = Get-Content $AWSCredsPath -Raw
    if ($CredsContent -match "qubole") {
        Write-Log "[!] Found Qubole references in AWS credentials file"
        Write-Log "    Path: $AWSCredsPath"
        Write-Log "    Last Modified: $((Get-Item $AWSCredsPath).LastWriteTime)"
    }
}

# Check 5: Event logs for suspicious process execution (TruffleHog)
Write-Log "`n[+] Checking Windows Event Logs for TruffleHog execution..."
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} -MaxEvents 5000 | 
    Where-Object { $_.Message -match "trufflehog" } | 
    Select-Object TimeCreated, Message -First 20

if ($Events) {
    Write-Log "[!] Found TruffleHog execution events:"
    $Events | ForEach-Object {
        Write-Log "    - $($_.TimeCreated): $($_.Message.Substring(0, [Math]::Min(200, $_.Message.Length)))..."
    }
}

# Check 6: AWS CloudTrail for AssumeRole events (requires AWS CLI)
Write-Log "`n[+] Querying AWS CloudTrail for suspicious AssumeRole events..."
try {
    $StartTime = (Get-Date).AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ss")
    $EndTime = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ss")
    
    $Events = aws cloudtrail lookup-events `
        --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole `
        --start-time $StartTime `
        --end-time $EndTime `
        --max-results 100 `
        --query 'Events[?contains(CloudTrailEvent, `qubole`)]' `
        --output json 2>$null
    
    if ($Events -and $Events -ne "[]") {
        Write-Log "[!] Found Qubole-related AssumeRole events in CloudTrail"
        $Events | Out-File -Append $ReportPath
    } else {
        Write-Log "    No Qubole-related AssumeRole events found in CloudTrail"
    }
} catch {
    Write-Log "    [!] AWS CLI not configured or insufficient permissions to query CloudTrail"
}

# Check 7: Recent IAM user creation or access key generation
Write-Log "`n[+] Checking for recently created IAM users or access keys..."
try {
    $Users = aws iam list-users --query 'Users[?CreateDate>`2026-10-01`]' --output json 2>$null
    if ($Users -and $Users -ne "[]") {
        Write-Log "[!] Recently created IAM users detected:"
        $Users | Out-File -Append $ReportPath
    }
    
    $AccessKeys = aws iam list-access-keys --query 'AccessKeyMetadata[?CreateDate>`2026-10-01`]' --output json 2>$null
    if ($AccessKeys -and $AccessKeys -ne "[]") {
        Write-Log "[!] Recently created access keys detected:"
        $AccessKeys | Out-File -Append $ReportPath
    }
} catch {
    Write-Log "    [!] Unable to query IAM information"
}

Write-Log "`n=== Hunt Complete ==="
Write-Log "Report saved to: $ReportPath"

# Generate summary
$Summary = @"
`n=== EXECUTIVE SUMMARY ===
Date: $(Get-Date)
Hostname: $env:COMPUTERNAME
User: $env:USERNAME
Malicious IPs Checked: $($MaliciousIPs.Count)
TruffleHog Hashes Checked: $($TruffleHogHashes.Count)

Recommended Actions:
1. Review AWS CloudTrail for unauthorized AssumeRole events
2. Rotate all IAM access keys potentially exposed to Qubole integration
3. Review S3 bucket policies for unauthorized external access
4. Audit secrets stored in code repositories and configuration files
5. Implement least-privilege for cross-account roles
"@

Add-Content -Path $ReportPath -Value $Summary
Write-Host $Summary