Lesson 5.4: Investigating a stolen cloud key
At 23:20 the SIEM raises an alert: the reporting robot's access key is making API calls from an unknown address, and most of them fail. In the lab you investigate with CloudTrail: separate the robot's normal activity from the attacker's, read what the attacker tried (enumeration, privilege escalation, persistence, crypto-mining instances, switching off logging) and what actually succeeded, contain the key, check for persistence anyway, and see how the least-privilege policy from section 1 turned a potential account takeover into a non-event.
18 min
You will learn to
- Separate normal from malicious use of a credential
- Read CloudTrail error codes
- Recognise attacker goals from API calls
- Contain a stolen key
- Check for cloud persistence
Key terms
- errorCode
- The CloudTrail field that records why a call failed.
- Blast radius
- How much damage a compromised identity or system can cause.
- Cloud persistence
- Ways attackers keep access: new users or keys, new roles with trust to their account, modified policies.
- Resource hijacking
- Using a victim's cloud resources, often GPU instances for crypto-mining.
- Threat detection services
- Provider services that analyse logs for these patterns.
← IDS alerts with Suricata · All lessons · Certificates and PKI →