The Advent of Cyber: Day 7: AWS log analysis - Oh, no. I'M SPEAKING IN CLOUDTRAIL! (TryHackMe)

Search for a command to run...

No comments yet. Be the first to comment.
Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

In this article, we’ll cover the AWS log analysis - Oh, no. I'M SPEAKING IN CLOUDTRAIL! write-up as the Day 7 challenge of the Advent of Cyber event challenge. It was interesting to monitor an AWS Environment i.e. AWS CloudWatch, AWS CloudTrail (S3 & IAM), and Intro to JQ - Command line JSON using the command line. We’re still at Wareville for SOC-mas!
What is the other activity made by the user glitch aside from the ListObject action? PutObject

What is the source IP related to the S3 bucket activities of the user glitch? 53.94.201.69

Based on the eventSource field, what AWS service generates the ConsoleLogin event? signin.amazonaws.com

When did the anomalous user trigger the ConsoleLogin event? 2024-11-28T15:21:54Z
(based on the image above)

What was the name of the user that was created by the mcskidy user? glitch

What type of access was assigned to the anomalous user? AdministratorAccess

Which IP does Mayor Malware typically use to log into AWS? 53.94.201.69

What is McSkidy's actual IP address? 31.210.15.79

What is the bank account number owned by Mayor Malware? 2394 6912 7723 1294

Want to learn more about log analysis and how to interpret logs from different sources? Check out the Log Universe room!
Thank you for reading this article. Please leave a comment with your thoughts, areas for improvement, other suggestions, and questions. Stay secure until the next one!