PinnedThreat detection🕵️♂️ in AWS using Amazon Athena ServiceI recommend starting with the article below before beginning the Hands-on lab.😉🕵️♂️ https://medium.com/@goodycyb/threat-detection-in-aws-using-amazon-athena-to-analyze-cloudtrail-logs-from-flaws-cloud-00a43348d18a Objective In this lab, you wil...Feb 4, 2024·17 min read
SANS AWS DetectionLifecycle Process Research the attack technique — Lab 1 Set up proper logging — Lab 2 Attack realistic assets — Lab 3 Review log data — Lab 4 Build detection — Lab 5 Prerequisites: An AWS account with administrator access NOTE: In this lab, y...Aug 30, 2023·2 min read
Lab 5: Building an Automated DetectionLab Objective View the Lambda function that will handle the event Create an AWS EventBridge rule to capture CloudTrail data events involving your password-backup honey file and trigger a Lambda function called HoneyFileDetection Perform T1530 (Dat...Aug 30, 2023·6 min read
Lab 6: Deleting Created ResourcesLab Objective Tear down evidence-app resources using destroy.sh (Optional) Reset CloudShell home directory contents Challenge 1: Teardown Resources Log back into your CloudShell session and use destroy.sh to destroy the deployed resources On you...Aug 30, 2023·1 min read
Lab 4: Detecting the AttackLab Objective Discover where the CloudTrail data is being written to within the cloudlogs- S3 bucket Download just today's data to your CloudShell session Analyze the data, looking for all API calls made related to the download of the honey file ...Aug 30, 2023·3 min read
Lab 3: Attacking the Cloud AccountLab Objective You will act as an attacker in the following ways to generate log data, which will help build your detection and automation: Perform discovery of S3 resources - ATT&CK Technique T1619 (Cloud Storage Object Discovery) Download an inte...Aug 30, 2023·3 min read
Lab 2: Setting up API Event LoggingCloud Visibility through Cloud Management Event Logging and S3 Object Access Logging would help achieve comprehensive visibility into the cloud environment. Cloud Management Event Logging involves capturing and analyzing events generated by various c...Aug 30, 2023·4 min read
