AWSRaid - CyberDefenders Lab Writeup

Your organization utilizes AWS to host critical data and applications. An incident has been reported that involves unauthorized access to data and potential exfiltration. The security team has detected unusual activities and needs to investigate the incident to determine the scope of the attack.

Easy - Cloud Forensics | Completion Achievement

1. Knowing which user account was compromised is essential for understanding the attacker's initial entry point into the environment. What is the username of the compromised user?

Let's look into login attempts inside the AWS Cloudtrail logs using the following query:

index="aws_cloudtrail" eventName=consoleLogin "responseElements.ConsoleLogin"=Failure
| stats count by userIdentity.userName
| sort -count

A username with a higher amount of failed login attempts than other user accounts is suspicious.

2. We must investigate the events following the initial compromise to understand the attacker's motives. What is the timestamp for the first access to an S3 object by the attacker?

Knowing the username of the attacker, we just need to sort GetObject events based on their timestamp, which can be done with the following SPL query:

index="aws_cloudtrail" userIdentity.userName="helpdesk.luke" eventName=GetObject
| sort eventTime

3. Among the S3 buckets accessed by the attacker, one contains a DWG file. What is the name of this bucket?

We can filter out the GetObject events to find a dwg string corresponding to a DWG file using the following query:

index="aws_cloudtrail" userIdentity.userName="helpdesk.luke" eventName=GetObject dwg

The field containing the bucket name is the requestParameters.bucketName field.

4. We've identified changes to a bucket's configuration that allowed public access, a significant security concern. What is the name of this particular S3 bucket?

Let's try looking at all eventName values and filter for rare values: index="aws_cloudtrail" | stats count by eventName| sort count . The PutBucketPublicAccessBlock value stands out because it only appears once, and it seems to be related to public bucket access. Let's get the name of the bucket:

5. Creating a new user account is a common tactic attackers use to establish persistence in a compromised environment. What is the username of the account created by the attacker?

Going back to our list of rare events sorted by count, we can find a few interesting EventNames based on user account creation:

Let's look into CreateUser and observe the requestParameters.userName field:

6. Following account creation, the attacker added the account to a specific group. What is the name of the group to which the account was added?

Let's check that other rare EventName field to see find the specific group. Just like in the previous question, there is only a single log. Let's display what the single value in requestParameters.groupName is: