Series
AWS incident response
6 posts in this series. Read them in order or jump to any one.
- AWS incident response: investigating a compromised account
AWS account compromised? What to do first, which logs to secure, how to scope the attack in CloudTrail and how to contain it without destroying evidence.
- How to investigate a leaked AWS access key
A leaked AWS access key: deactivate it, then use CloudTrail to find where it was used, what it enumerated, what it created and which data it could reach.
- S3 data exfiltration detection: what the logs can prove
Prove or rule out S3 data theft: CloudTrail data events, S3 server access logs, public bucket policies, shared snapshots, and what you cannot see without them.
- AWS crypto-mining on a compromised account: respond fast
GPU instances, a bill spike, a region nobody uses: confirm crypto-mining on AWS from CloudTrail and flow logs, contain it, and find how they got in.
- AWS incident response example: leaked key to crypto-mining
A fictional AWS incident investigated from its logs: leaked key, recon, backdoor admin, GuardDuty deleted, 320 S3 objects taken, GPU mining in Singapore.
- CloudTrail limitations: what log forensics cannot tell you
What CloudTrail, VPC Flow Logs and S3 access logs do not record, where baselines fail, and how to write honest conclusions when evidence is missing.