LetsDefend: AWS Bucketware — thinking your way through CloudTrail

A hard cloud IR challenge, and the one I deliberately do not hand you the answers to. Building an API-call cheat sheet, spotting the compromised identity, and the versioning trick behind the whole attack.

Careful

Keep it open on a second screen.

I started by reading a handful of logs just to get a feel for normal. The IAM admin looked entirely legitimate — nothing odd about what it was doing.

That's the tell, and it's a behavioural one rather than a technical one:

Tip

As I went, I kept a notepad open and wrote down every API call that matched my cheat sheet and every user that looked off. That list becomes the answer to several later questions.

Put yourself in their position. You have credentials in an AWS environment and you want to keep access. What do you do?

You create a user.

For the ordering question, this is where having your files in chronological order pays off — read the odd usernames out in the order they appear.

The protection question is the interesting one, and it wasn't on my cheat sheet. I had to go and research which API call would protect a bucket.

So an attacker checks whether versioning is enabled, and if it is, they turn it off before doing anything destructive.

Tip

There's a mention of a ransom note in the challenge, which tells you the file type to hunt for. I tried the obvious extensions — PDF, CSV, txt, doc — and searched the logs for each until one came back.

Honestly, I don't think this is a hard challenge in the technical sense. What it requires is that you educate yourself first, then have the patience to actually look through the files. You can do it with a terminal and scripts if you prefer — I chose to read the raw files this time.

I try to keep my videos under ten minutes, so if you want more depth or want the cheat sheets I build for myself, reach out and I'll gladly send them over.

Have a great day!

Contents

Skills covered