Skip to content
AWSForensics

This tool is not affiliated with, endorsed by or sponsored by Amazon Web Services, Inc. or Amazon.com, Inc. AWS, Amazon Web Services, CloudTrail and GuardDuty are trademarks of Amazon.com, Inc. or its affiliates. Other names are trademarks of their respective owners.

Posts tagged: #crypto-mining

← Back to all posts
AWS incident response example: leaked key to crypto-mining
A fictional AWS incident investigated from its logs: leaked key, recon, backdoor admin, GuardDuty deleted, 320 S3 objects taken, GPU mining in Singapore.
incident-responsecloudtrailaccess-keysdata-exfiltration
VPC Flow Logs analysis for exfiltration and mining
Reading VPC Flow Logs in an investigation: key fields, egress volume per destination, mining-pool ports, what flow logs never record and the data traps.
vpc-flow-logsdata-exfiltrationcrypto-miningdetection
AWS crypto-mining on a compromised account: respond fast
GPU instances, a bill spike, a region nobody uses: confirm crypto-mining on AWS from CloudTrail and flow logs, contain it, and find how they got in.
crypto-miningincident-responsecloudtrailvpc-flow-logs

This tool is not affiliated with, endorsed by or sponsored by Amazon Web Services, Inc. or Amazon.com, Inc. AWS, Amazon Web Services, CloudTrail and GuardDuty are trademarks of Amazon.com, Inc. or its affiliates. Other names are trademarks of their respective owners.