SG-027: Lateral Movement

Severity: CRITICAL

AWS/GCP/Azure cross-account pivots, SSH lateral movement, CI/CD token abuse, port forwarding

Fires when

• A cloud cross-account/privilege pivot: AWS `sts assume-role`, GCP service-account activation from a suspicious key source, a GCP high-privilege IAM binding, or Azure service-principal login.
• SSH/SCP/rsync to an internal RFC-1918 host, or kubectl exec / cross-namespace operations (container pivot).
• CI/CD token abuse (a CI token passed into an HTTP Authorization Bearer request), or network pivoting via port forwarding, a pivoting tool (chisel/frp/ligolo), or proxy chaining.
• Access to an internal/private network service: an RFC-1918 URL, a database connection string to a private-IP host, or etcd/consul/vault access.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://attack.mitre.org/tactics/TA0008/