The scenario is fictional (RFC 5737 IPs; account and key IDs are made up). AWS details come from the book and aren't tested live.
The same jdoe whose credentials we followed on-prem shows up in the cloud. Logged in at 09:02; CloudTrail was stopped by 09:15. No MFA.
What you'll learn
- A 13-minute compromise timeline in CloudTrail
- Recon -> escalation -> persistence -> exfiltration -> concealment, with API names
- How GuardDuty, VPC Flow Logs and CloudTrail complement each other
- Guardrails: MFA, SCP, Access Analyzer
Timeline
| Time | Event | Meaning |
|---|---|---|
| 09:02 |
ConsoleLogin jdoe, no MFA, 203.0.113.77
|
entry |
| 09:03 |
GetCallerIdentity/ListUsers/ListRoles/ListBuckets
|
recon |
| 09:05 |
AttachUserPolicy AdministratorAccess |
self-escalation |
| 09:07 |
CreateUser svc-backup + CreateAccessKey
|
backdoor |
| 09:10 | GetObject corp-financials/payroll.csv |
exfiltration |
| 09:12 |
ModifySnapshotAttribute share snap-01 to 999988887777
|
exfiltration (snapshot) |
| 09:15 | StopLogging org-trail |
concealment |
When logging stops, evidence remains
GuardDuty Stealth:IAMUser/CloudTrailLoggingDisabled; VPC Flow Logs showed large egress after the stop; log file validation plus S3 Object Lock and a separate log account protect integrity.
Guardrails
- Require MFA.
- SCPs denying
StopLogging,DeleteTrail, GuardDuty disablement. - Access Analyzer for external sharing.
- Avoid long-lived access keys.
- Data events on sensitive buckets.
Checklist
MFA on login? Self-granted policies? New users/keys? External shares of snapshots/AMIs/buckets? Logging stopped, and the gap after?
That closes season one: one campaign, four environments.
Adapted from chapter 33 of my Japanese book on server defense (40 chapters, with a laptop-sized lab).
Top comments (0)