AWS DFIR - Investigating a Compromised AWS Environment

To get started with the Certified Cyber Defender, visit https://bit.ly/cwx-cyberdefenders and use the code cyberwox1123t10. The first 10 of you will get 10% off your purchase of the CCD training.

Cloud IAM Security: https://youtu.be/7ZqVRYVmRjM?si=MXo4y4smwmzvAOHR

_____________
TIMESTAMPS

00:00 Intro
02:15 Lab Start
02:54 Navigating Cloudtrail Logs & Regions
06:01 Finding the attacker's IP
13:34 Going down a rabbit hole
18:02 Parsing through all CloudTrail regions
19:39 Initial interaction from the attacker
20:25 Finding the stolen access key
26:56 Finding privilege escalation …

access amp attacker cloudtrail compromised defense down escalation evasion key lab logs parsing persistence privilege privilege escalation start stolen timestamps