Cloud Security
Difficulty: medium
Log Format: syslog
Golden Key
Your AWS CloudTrail lit up with API calls from an IP you've never seen before. Within 3 minutes they enumerated your entire infrastructure, created a new IAM user, and attached it to the Administrator policy. By the time the alert fired, they were already gone. Find out how they got in and what they accessed.
AWSIAMLateral Movement
Investigation Scenario
Your AWS CloudTrail lit up with API calls from an IP you've never seen before. Within 3 minutes they enumerated your entire infrastructure, created a new IAM user, and attached it to the Administrator policy. By the time the alert fired, they were already gone. Find out how they got in and what they accessed.