Incident response guide for AWS CloudTrail investigations – Part 1

Source: AWS Security Blog

Author: Oscar Diaz

URL: https://aws.amazon.com/blogs/security/incident-response-guide-for-aws-cloudtrail-investigations-part-1/

ONE SENTENCE SUMMARY:

Guide teaches CloudTrail-based incident investigations, highlighting key fields, attacker patterns, and response checklists across cross-account S3 deletion and cryptomining scenarios.

MAIN POINTS:

  1. CloudTrail investigation hinges on interpreting specific fields, context, and event chains.
  2. Real-world scenarios cover cross-account unauthorized access, ransomware-like deletions, and console-driven cryptomining.
  3. Terminology glossary defines recon, enumeration, lateral movement, persistence, and other IR concepts.
  4. Scenario 1 starts with assumed-role activity performing S3 ListBuckets reconnaissance.
  5. Suspicious session naming can indicate masquerading to blend into normal automation noise.
  6. Listing objects followed by a silence gap suggests planning before rapid automated execution.
  7. S3 COPY operations before DELETE imply steal-then-destroy behavior and possible exfiltration.
  8. Tight deletion timing, consistent IP, and aws-cli user agent indicate scripted automation.
  9. Broad cross-account role permissions expose blast-radius risk without least-privilege and reviews.
  10. Scenario 2 shows CloudFormation abuse via console session and CloudShell, lacking MFA.

TAKEAWAYS:

  1. Prioritize containment by confirming ongoing access, sensitive exposure, and spread potential.
  2. Validate cross-account trust policies and role assumption paths to identify initial compromise.
  3. Correlate source IPs, session names, and user agents to uncover pivots and related actions.
  4. Treat cost anomalies as security signals; billing spikes can reveal resource hijacking early.
  5. Enforcing MFA for console access blocks many credential-abuse paths enabling rapid automation.