Cloud Triage: Luminaut Tool Maps Exposed AWS/GCP Assets for Rapid Security Investigation

Luminaut is a utility to scope cloud environment exposure for triage. The goal is to quickly identify exposed resources and collect information to start an investigation.

Starting from the public IP addresses of AWS Elastic Network Interfaces (ENIs) and GCP Compute Engine instances, plus public URIs of GCP Cloud Run services, Luminaut gathers information about the associated resources, security configurations, and related events. The framework includes active scanning tools like nmap and whatweb, to identify services running on exposed ports, and passive sources like Shodan.

By combining cloud configuration data with external sources, Luminaut provides context to guide the next steps of an investigation.

Luminaut supports both AWS and GCP environments, with modular architecture allowing for the addition of new cloud providers, tools, and services as needed.

Features

• Enumerate ENIs with public IPs.
• Gather information about associated EC2 instances and Elastic load balancers.
• Identify permissive rules for attached security groups.
• Scan CloudTrail history for related events to answer who, what, and when.
  • Supports querying for activity related to discovered ENI, EC2, ELB, and Security Group resources.
  • Optionally specify a time frame to limit the scan to a specific time period.
• Query AWS Config for resource configuration changes over time.
  • Supports scanning AWS Config history for the discovered ENI and EC2 Instance associated with the ENI.
  • Optionally specify a time frame to limit the scan to a specific time period.
• Skip scanning and reporting on resources based on the resource id or tag values
  • Supports skipping based on the resource id of the ENI.

• Enumerate Compute Engine instances with public IPs.
• Enumerate Cloud Run services with public URIs.
• Identify permissive firewall rules that allow external access to instances.
• Query GCP audit logs for instance and service lifecycle events to answer who, what, and when.
  • Supports querying for activity related to discovered Compute Engine instances and Cloud Run services.
  • Optionally specify a time frame to limit the scan to a specific time period.

• nmap to scan common ports and services against identified IP addresses.
  • nmap will only scan ports associated with permissive security group rules or a load balancer listener.
• whatweb to identify services running on ports associated with exposed security group ports.
  • whatweb will only scan ports associated with permissive security group rules or a load balancer listener.

• shodan to gather information about exposed services and vulnerabilities.

• Console output with rich formatting, displaying key information.
• HTML capture of console output to preserve prior executions.
• CSV Timeline of events from CloudTrail, GCP audit logs, and other sources.
• JSON lines output with full event information for parsing and integration with other tools.

Install & Use

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy