feat: T1648-1

[ryananicholson]

Details:

Created a new attack for T1648 for AWS. The process that is mimicked is:

• Attacker has access to credentials with lambda:UpdateFunctionCode and lambda:InvokeFunction rights or the equivalent
• Function has an overly-permissive IAM role
• Function code is altered to create a backdoor IAM user account

Testing:

Executed the atomic test with the following command:

Invoke-AtomicTest -AtomicTechnique T1648 -InputArgs @{profile="default"; region="us-east-2"} -PathToAtomicsFolder ./atomics

To cleanup, I ran the following:

Invoke-AtomicTest -AtomicTechnique T1648 -InputArgs @{profile="default"; region="us-east-2"} -PathToAtomicsFolder ./atomics -Cleanup

Associated Issues:

No issues corrected with this PR.

[patel-bhavin]

Neat atomic @ryananicholson ! thank you for the contribution! Curious to know if you have seen any reference to any blogs/research where you may have seen this TTP ? I think it might be good to add it to the description in case there is one! Else the PR looks good!