What are typical patterns of AWS security breaches? CloudTrail× GuardDuty Practice Checklist

Translated from 日本語 • View original

西田

Hello, this is Nishida from Colorkrew Security. When investigating security incidents in your AWS environment, the entrance is almost fixed.

"The access key was pushed to GitHub"
"SSH was fully open for the old EC2 instance"
"MFA was not set up for an IAM user with admin privileges"

You may think, "No way," but these things continue to happen today.
CloudTrail × GuardDuty as the hub to present a checklist to crush common entry points.

1. Top 3 AWS Breach Patterns

Pattern (1): Access Key Leakage

The IAM user's access key (Access Key ID+Secret Access Key) is:

Commit to GitHub
Published to S3 bucket
Output to CI/CD logs

The attacker obtains this and performs EC2 spawns and massive S3 access.

Pattern (2): Abuse of Overprivileged IAM Roles

AdministratorAccess-equivalent roles:

Assigned to EC2 Instance Profile
Assigned to a Lambda function

If EC2 or Lambda is compromised, your entire AWS account will take control.

Pattern (3): S3 Bucket Misexposure

Sensitive data is stored in a bucket where 'Block Public Access' is disabled due to a misconfiguration.

2. See what's happening with CloudTrail

CloudTrail logs all API calls on AWS.
Prioritize monitoring the following events:

High-priority monitoring events:

# Possibility of privilege escalation
iam:CreateAccessKey
iam:AttachUserPolicy
iam:PutUserPolicy

# Suspicious use of credentials
sts:AssumeRole (from regions you don't usually use)
ConsoleLogin (no MFA, abnormal time zone)

# Potential for data exfiltration
s3: GetObject (large volume, short time)
ec2: DescribeInstances

These are monitored as KQL/SQL queries in Sentinel, Athena, etc.

3. Leveraging GuardDuty: AI-powered automated detection

AWS GuardDuty uses machine learning to analyze CloudTrail, VPC Flow Logs, and DNS logs to automatically detect threats.

Typical detection categories:

Recon: Port scanning, IAM reconnaissance
CryptoCurrency (mining): Mining communication on EC2
UnauthorizedAccess: API calls from unusual locations
Stealth (Stealth Behavior): Disable CloudTrail, Configure Change

An important premise for GuardDuty: Enable across all regions.
An attacker may launch EC2 in a region that you are not using.

4. Colorkrew Security's Approach

**The entry point for an AWS breach is almost fixed. Continuous monitoring with CloudTrail × GuardDuty. This step is the first line of defense. **

If you want to check whether your company's AWS environment is really set up correctly, the shortest route is to consult an expert first. Colorkrew Security helps you design, audit, and respond to incidents in your AWS environment.