Lifecycle Process Research the attack technique — Lab 1 Set up proper logging — Lab 2 Attack realistic assets — Lab 3 Review log data — Lab 4 Build detection — Lab 5 Prerequisites: An AWS account with administrator access NOTE: In this lab, y...
Lab Objective View the Lambda function that will handle the event Create an AWS EventBridge rule to capture CloudTrail data events involving your password-backup honey file and trigger a Lambda function called HoneyFileDetection Perform T1530 (Dat...
Lab Objective Tear down evidence-app resources using destroy.sh (Optional) Reset CloudShell home directory contents Challenge 1: Teardown Resources Log back into your CloudShell session and use destroy.sh to destroy the deployed resources On you...
Lab Objective Discover where the CloudTrail data is being written to within the cloudlogs- S3 bucket Download just today's data to your CloudShell session Analyze the data, looking for all API calls made related to the download of the honey file ...
Lab Objective You will act as an attacker in the following ways to generate log data, which will help build your detection and automation: Perform discovery of S3 resources - ATT&CK Technique T1619 (Cloud Storage Object Discovery) Download an inte...
Cloud Visibility through Cloud Management Event Logging and S3 Object Access Logging would help achieve comprehensive visibility into the cloud environment. Cloud Management Event Logging involves capturing and analyzing events generated by various c...
