1. INITIAL ACCESS     → WAF detects Next-Action header + prototype pollution payloads
2. EXECUTION          → GuardDuty ThreatIntelSet detects C2 IP connections
3. CREDENTIAL THEFT   → CloudTrail detects GetCallerIdentity from EC2 roles
4. LATERAL MOVEMENT   → EventBridge rules detect SSM SendCommand/StartSession
5. EXFILTRATION       → DNS exfiltration to ceye.io/dnslog.cn detected
6. CRYPTOMINING       → GuardDuty detects cryptocurrency mining activity

# Minimum IAM permissions for the detection script
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudtrail:LookupEvents",
        "logs:StartQuery",
        "logs:GetQueryResults",
        "guardduty:ListDetectors",
        "guardduty:ListFindings",
        "guardduty:GetFindings",
        "guardduty:CreateThreatIntelSet",
        "guardduty:UpdateThreatIntelSet",
        "guardduty:ListThreatIntelSets",
        "guardduty:GetThreatIntelSet",
        "s3:PutObject",
        "s3:GetObject",
        "sts:GetCallerIdentity",
        "sts:AssumeRole"
      ],
      "Resource": "*"
    }
  ]
}

# For Security Hub integration, add:
"securityhub:BatchImportFindings"

# For SNS alerting, add:
"sns:Publish"

# For organization-wide scanning, add:
"organizations:ListAccounts"

# Navigate to project
cd React2Shell_Hunter

# Create virtual environment (RECOMMENDED)
python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Option A: Use AWS CLI profile
aws configure --profile security-scanner

# Option B: Export environment variables
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_DEFAULT_REGION="us-east-1"

# Option C: Use IAM role (recommended for EC2/Lambda)
# Attach appropriate IAM role to your compute resource

# Test AWS connectivity
aws sts get-caller-identity

# Test Python dependencies
python -c "import boto3, yaml; print('Dependencies OK')"

# Test IOC loading
python -c "
import yaml
with open('config/iocs.yaml') as f:
    iocs = yaml.safe_load(f)
    print(f'Loaded {len(iocs[\"network_iocs\"][\"malicious_ips\"])} malicious IPs')
"

python src/react2shell_detector.py --hours 24

2025-12-06 10:00:00 - React2ShellDetector - INFO - ============================================================
2025-12-06 10:00:00 - React2ShellDetector - INFO - React2Shell IOC Detection Script
2025-12-06 10:00:00 - React2ShellDetector - INFO - CVE-2025-55182 & CVE-2025-66478
2025-12-06 10:00:00 - React2ShellDetector - INFO - ============================================================
2025-12-06 10:00:00 - React2ShellDetector - INFO - Starting single account scan...
2025-12-06 10:00:00 - React2ShellDetector - INFO - Analyzing CloudTrail logs...
2025-12-06 10:00:05 - React2ShellDetector - INFO - Checking GuardDuty findings...

Total findings: 0
  CRITICAL: 0
  HIGH: 0
  MEDIUM: 0

python src/react2shell_detector.py \
    --organization \
    --role-name SecurityAuditRole \
    --security-hub \
    --guardduty-bucket my-threat-intel-bucket-12345 \
    --vpc-log-group /aws/vpc/flowlogs \
    --waf-log-group aws-waf-logs-react2shell \
    --sns-topic arn:aws:sns:us-east-1:123456789012:security-alerts \
    --output json \
    --output-file findings-$(date +%Y%m%d).json \
    --hours 72

┌─────────────────────────────────────────────────────────────────────────────┐
│                           DETECTION ARCHITECTURE                             │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│   DATA SOURCES              DETECTION ENGINE           RESPONSE              │
│   ════════════              ════════════════           ════════              │
│                                                                              │
│   ┌──────────┐             ┌─────────────────┐        ┌───────────┐         │
│   │CloudTrail│────────────>│    GuardDuty    │───────>│EventBridge│         │
│   │  Logs    │             │    Detector     │        │   Rules   │         │
│   └──────────┘             │                 │        └─────┬─────┘         │
│                            │ ┌─────────────┐ │              │               │
│   ┌──────────┐             │ │ThreatIntel  │ │              ▼               │
│   │VPC Flow  │────────────>│ │Set (C2 IPs) │ │        ┌───────────┐         │
│   │  Logs    │             │ └─────────────┘ │        │    SNS    │         │
│   └──────────┘             └─────────────────┘        │   Topic   │         │
│                                                        └─────┬─────┘         │
│   ┌──────────┐             ┌─────────────────┐              │               │
│   │DNS Query │────────────>│    Route 53     │              ▼               │
│   │  Logs    │             │    Resolver     │        ┌───────────┐         │
│   └──────────┘             └─────────────────┘        │  Lambda   │         │
│                                                        │ (Enrich)  │         │
│   ┌──────────┐             ┌─────────────────┐        └─────┬─────┘         │
│   │   WAF    │────────────>│   WAF WebACL    │              │               │
│   │  Logs    │             │  (HTTP Rules)   │              ▼               │
│   └──────────┘             └─────────────────┘        ┌───────────┐         │
│                                                        │ Security  │         │
│                                                        │    Hub    │         │
│                                                        └───────────┘         │
└─────────────────────────────────────────────────────────────────────────────┘

React2Shell_Hunter/
├── config/
│   └── iocs.yaml                    # IOC database (IPs, domains, patterns) - 452 lines
├── src/
│   └── react2shell_detector.py      # Main detection script - 1141 lines
├── terraform/
│   ├── guardduty.tf                 # GuardDuty + ThreatIntelSet + S3 - 405 lines
│   ├── eventbridge_rules.tf         # 7 EventBridge rules - 533 lines
│   └── waf_rules.tf                 # WAF WebACL with 9 rules - 681 lines
├── lambda/
│   └── ioc_scanner/
│       └── handler.py               # Real-time Lambda scanner - 381 lines
├── athena_queries/
│   └── detection_queries.sql        # 18 threat hunting queries - 483 lines
├── tests/
│   ├── __init__.py                  # Test package init
│   ├── conftest.py                  # Pytest fixtures (project_root, ioc_config, etc.)
│   ├── test_ioc_matching.py         # IOC pattern validation tests
│   ├── test_terraform.py            # Terraform configuration validation
│   └── test_waf_patterns.py         # WAF regex pattern tests
├── docs/
│   ├── THREAT_INTELLIGENCE_REPORT.md
│   └── GUARDDUTY_EVENTBRIDGE_SETUP_GUIDE.md
├── requirements.txt                 # Python dependencies (boto3, pyyaml, pytest, python-hcl2)
├── README.md
└── CLAUDE.md

cd terraform

# Initialize Terraform
terraform init

# Preview changes (ALWAYS DO THIS FIRST)
terraform plan \
    -var="threat_intel_bucket=react2shell-threat-intel-$(aws sts get-caller-identity --query Account --output text)" \
    -var="enable_guardduty=true" \
    -var="enable_waf=true" \
    -var="waf_scope=REGIONAL"

# Apply changes
terraform apply \
    -var="threat_intel_bucket=react2shell-threat-intel-$(aws sts get-caller-identity --query Account --output text)"

# Associate with ALB
aws wafv2 associate-web-acl \
    --web-acl-arn $(terraform output -raw web_acl_arn) \
    --resource-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890

# Associate with API Gateway
aws wafv2 associate-web-acl \
    --web-acl-arn $(terraform output -raw web_acl_arn) \
    --resource-arn arn:aws:apigateway:us-east-1::/restapis/abc123/stages/prod

# Get SNS topic ARN
SNS_TOPIC=$(terraform output -raw sns_topic_arn)

# Subscribe email
aws sns subscribe \
    --topic-arn $SNS_TOPIC \
    --protocol email \
    --notification-endpoint [email protected]

# Subscribe Slack webhook (via Lambda)
aws sns subscribe \
    --topic-arn $SNS_TOPIC \
    --protocol lambda \
    --notification-endpoint arn:aws:lambda:us-east-1:123456789012:function:slack-notifier

# Open Athena console or use AWS CLI
# Run the CREATE TABLE statements from athena_queries/detection_queries.sql

# CloudTrail table
aws athena start-query-execution \
    --query-string "CREATE EXTERNAL TABLE cloudtrail_logs ..." \
    --work-group primary \
    --query-execution-context Database=default

# Check if GuardDuty is enabled
aws guardduty list-detectors

# If empty, enable GuardDuty
aws guardduty create-detector --enable

# Or use Terraform
terraform apply -var="enable_guardduty=true"

# Verify role exists in target account
aws iam get-role --role-name SecurityAuditRole

# Verify trust policy allows your account
aws iam get-role --role-name SecurityAuditRole --query 'Role.AssumeRolePolicyDocument'

# Test role assumption
aws sts assume-role \
    --role-arn arn:aws:iam::TARGET_ACCOUNT:role/SecurityAuditRole \
    --role-session-name test

# Check ThreatIntelSet status
DETECTOR_ID=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)
aws guardduty list-threat-intel-sets --detector-id $DETECTOR_ID

# Verify S3 bucket permissions
aws s3api get-bucket-policy --bucket your-threat-intel-bucket

# Verify IP list format (one IP per line, no CIDR)
aws s3 cp s3://your-bucket/threat-intel/react2shell-ips.txt -

# Check if WebACL is associated
aws wafv2 list-resources-for-web-acl \
    --web-acl-arn $(terraform output -raw web_acl_arn)

# Check sampled requests
aws wafv2 get-sampled-requests \
    --web-acl-arn $(terraform output -raw web_acl_arn) \
    --rule-metric-name React2Shell-Malicious-IP-Blocked \
    --scope REGIONAL \
    --time-window StartTime=2025-12-06T00:00:00Z,EndTime=2025-12-06T23:59:59Z \
    --max-items 10

# Generate sample findings to test pipeline
DETECTOR_ID=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)
aws guardduty create-sample-findings \
    --detector-id $DETECTOR_ID \
    --finding-types "UnauthorizedAccess:IAMUser/MaliciousIPCaller.Custom"

# Check EventBridge rule invocations
aws cloudwatch get-metric-statistics \
    --namespace AWS/Events \
    --metric-name Invocations \
    --dimensions Name=RuleName,Value=react2shell-malicious-ip-caller \
    --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ) \
    --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
    --period 300 \
    --statistics Sum

network_iocs:
  malicious_ips:
    - ip: "NEW.IP.ADDRESS.HERE"
      port: 8080
      context: "Description"
      confidence: high
      source: "Your source"

python src/react2shell_detector.py --guardduty-bucket your-bucket

# Install test dependencies
pip install -r requirements.txt

# Run all tests
pytest tests/ -v

# Run specific test categories
pytest tests/test_terraform.py -v      # Terraform validation
pytest tests/test_ioc_matching.py -v   # IOC pattern tests
pytest tests/test_waf_patterns.py -v   # WAF regex tests

# Run with coverage
pytest tests/ --cov=src --cov-report=html