Blog
Guides for investigating AWS incidents from CloudTrail, VPC Flow Logs, S3 access logs and GuardDuty: leaked keys, IAM backdoors, data theft, crypto-mining.
What CloudTrail, VPC Flow Logs and S3 access logs do not record, where baselines fail, and how to write honest conclusions when evidence is missing.
A fictional AWS incident investigated from its logs: leaked key, recon, backdoor admin, GuardDuty deleted, 320 S3 objects taken, GPU mining in Singapore.
Reading VPC Flow Logs in an investigation: key fields, egress volume per destination, mining-pool ports, what flow logs never record and the data traps.
GPU instances, a bill spike, a region nobody uses: confirm crypto-mining on AWS from CloudTrail and flow logs, contain it, and find how they got in.
Defense evasion on AWS: StopLogging, DeleteTrail, event selectors, GuardDuty detectors deleted, Config and Flow Logs removed, and what CloudTrail keeps.
Prove or rule out S3 data theft: CloudTrail data events, S3 server access logs, public bucket policies, shared snapshots, and what you cannot see without them.
How attackers keep access to AWS through IAM: backdoor users, extra keys, admin policies, role trust and identity providers, and how CloudTrail shows it.
The CloudTrail events every AWS responder should know, from recon to impact, with the fields that carry the evidence and their MITRE ATT&CK technique ids.
CloudTrail log analysis in your browser: load the exports, read the verdict and findings, pivot on keys and IPs, build the timeline, then remediate.