New attack technique: Persistence through federation

[adanalvarez]

What does this PR do?

• New attack technique

Motivation

I saw that this was an open and prioritized issue: #313

The current implementation creates an IAM user and a pair of access keys, one enabled and the other disabled. I use the enabled credentials to call the GetFederationToken API. This is not done directly from the credentials used in the Stratus Red Team session because GetFederationToken generates temporary security credentials for a user. If you're using a role to execute Stratus Red Team, this approach likely won't work. Instead, using the credentials of the IAM user created during the warmup phase allows us to successfully reproduce the GetFederationToken step.

Afterward, I only call the sts:GetCallerIdentity API to verify that the session works. I am not re-enabling the disabled access keys, as this requires interaction with the AWS Management Console.

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

[christophetd]

since this is coming from TF, is there any condition where these would be empty? I suspect this check might be unnecessary