https://www.awsforensics.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:44:29 GMT https://www.awsforensics.com/en/blog/aws-log-forensics-limitations https://www.awsforensics.com/en/blog/aws-log-forensics-limitations What CloudTrail, VPC Flow Logs and S3 access logs do not record, where baselines fail, and how to write honest conclusions when evidence is missing. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/aws-incident-walkthrough-leaked-key-to-cryptomining https://www.awsforensics.com/en/blog/aws-incident-walkthrough-leaked-key-to-cryptomining A fictional AWS incident investigated from its logs: leaked key, recon, backdoor admin, GuardDuty deleted, 320 S3 objects taken, GPU mining in Singapore. Florian Amette Wed, 23 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/vpc-flow-logs-analysis https://www.awsforensics.com/en/blog/vpc-flow-logs-analysis Reading VPC Flow Logs in an investigation: key fields, egress volume per destination, mining-pool ports, what flow logs never record and the data traps. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/aws-cryptomining-incident-response https://www.awsforensics.com/en/blog/aws-cryptomining-incident-response GPU instances, a bill spike, a region nobody uses: confirm crypto-mining on AWS from CloudTrail and flow logs, contain it, and find how they got in. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/cloudtrail-stoplogging-guardduty-disabled https://www.awsforensics.com/en/blog/cloudtrail-stoplogging-guardduty-disabled Defense evasion on AWS: StopLogging, DeleteTrail, event selectors, GuardDuty detectors deleted, Config and Flow Logs removed, and what CloudTrail keeps. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/s3-data-exfiltration-evidence https://www.awsforensics.com/en/blog/s3-data-exfiltration-evidence Prove or rule out S3 data theft: CloudTrail data events, S3 server access logs, public bucket policies, shared snapshots, and what you cannot see without them. Florian Amette Sun, 13 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/detect-iam-persistence-privilege-escalation https://www.awsforensics.com/en/blog/detect-iam-persistence-privilege-escalation How attackers keep access to AWS through IAM: backdoor users, extra keys, admin policies, role trust and identity providers, and how CloudTrail shows it. Florian Amette Fri, 11 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/cloudtrail-events-to-monitor https://www.awsforensics.com/en/blog/cloudtrail-events-to-monitor The CloudTrail events every AWS responder should know, from recon to impact, with the fields that carry the evidence and their MITRE ATT&CK technique ids. Florian Amette Wed, 09 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/cloudtrail-log-analysis-guide https://www.awsforensics.com/en/blog/cloudtrail-log-analysis-guide CloudTrail log analysis in your browser: load the exports, read the verdict and findings, pivot on keys and IPs, build the timeline, then remediate. Florian Amette Mon, 07 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/investigate-leaked-aws-access-key https://www.awsforensics.com/en/blog/investigate-leaked-aws-access-key A leaked AWS access key: deactivate it, then use CloudTrail to find where it was used, what it enumerated, what it created and which data it could reach. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/export-aws-logs-for-investigation https://www.awsforensics.com/en/blog/export-aws-logs-for-investigation Export CloudTrail logs from the trail bucket, event history or CloudTrail Lake, plus VPC Flow Logs, S3 access logs, GuardDuty findings and IAM reports. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.awsforensics.com/en/blog/aws-incident-response-compromised-account https://www.awsforensics.com/en/blog/aws-incident-response-compromised-account AWS account compromised? What to do first, which logs to secure, how to scope the attack in CloudTrail and how to contain it without destroying evidence. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT