Fantastic AWS Attacks and Where to Find Them
summary
Demonstrates concrete AWS detections mapped to the ATT&CK Cloud matrix: hunts for STS assume-role from EC2 metadata abuse, anomalous create-user & create-access-key events, suspicious security group ingress changes, and a novel policy version rollback technique that restores removed admin privileges. Recommends object-level CloudTrail for S3 GetObject size to quantify exfiltration, centralizes logs into centralized CloudTrail to security account across >1,000 accounts, and operationalizes alerts via Lambda pipelines using StreamAlert or similar with GuardDuty and Sigma-style rules on GitHub.
AI-written summary · about
chapters (8)
- 0:00Introduction to AWS attacks
- 1:05Initial access techniques
- 3:15Reconnaissance and discovery
- 5:21CloudTrail as a defense tool
- 8:10High-fidelity detection queries
- 12:47Operationalizing detections
- 16:23Building incident response workflow
- 19:24Q&A and resources
related talks
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
46mAttacking AWS: The Full Cyber Kill Chain
18mHow AWS Partners use observability to strengthen customer security
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
13mA guide to strengthening your threat detection and response
40mBringing a Machete to the Amazon
32mAdvanced threat detection and response on AWS
28mPatterns for scalable security detections on AWS