Amazon EC2 AMI exfiltration - Amazon Web Services (AWS) Tutorial

Contents

• Introduction Introduction

  • The rise of cloud threats

    37s
  • What you should know

    42s
• 1. MITRE Cloud Matrix 1. MITRE Cloud Matrix

  • (Locked)
    Understanding the MITRE Cloud Matrix

    1m 40s
  • (Locked)
    MITRE Cloud Tactics

    5m 7s
• 2. Log Analysis in AWS 2. Log Analysis in AWS

  • (Locked)
    Why you need cloud audit logs

    2m 58s
  • (Locked)
    Understanding cloud planes

    2m 38s
  • (Locked)
    CloudTrail basics

    3m 21s
  • (Locked)
    How CloudTrail works

    3m 21s
  • (Locked)
    CloudTrail demo

    2m 4s
  • (Locked)
    Creating your first trail

    1m 46s
• 3. CloudTrail Log Analysis 3. CloudTrail Log Analysis

  • (Locked)
    Introduction to CloudTrail log analysis with jq

    1m 11s
  • (Locked)
    jq installation

    42s
  • (Locked)
    Unzipping CloudTrail files in bulk

    2m 31s
  • (Locked)
    Analyzing AWS identities with jq

    1m 5s
  • (Locked)
    Analyzing AWS events with jq

    1m 5s
  • (Locked)
    Enumeration in AWS

    2m 47s
  • (Locked)
    Analyzing AWS enumeration events with jq

    2m 50s
  • (Locked)
    Extracting AWS event details with jq

    49s
  • (Locked)
    Introduction to CloudTrail log analysis with CloudTrail Lake

    1m 37s
  • (Locked)
    Getting started with AWS CloudTrail Lake

    1m 23s
  • (Locked)
    Challenge: Analyze CloudTrail Logs with jq

    41s
  • (Locked)
    Solution: Analyze CloudTrail Logs with jq

    2m 29s
• 4. Investigating Compute Threats 4. Investigating Compute Threats

  • (Locked)
    Analyzing enumeration attacks from EC2 instances

    2m 44s
  • (Locked)
    Amazon EC2 AMI exfiltration

    1m 54s
  • (Locked)
    Amazon EBS snapshot exfiltration

    1m 39s
• 5. Investigating IAM Threats 5. Investigating IAM Threats

  • (Locked)
    AWS access key leakage

    1m 16s
  • (Locked)
    Malicious IAM user creation

    1m 32s
  • (Locked)
    Malicious access key creation

    1m 29s
  • (Locked)
    Malicious login profile creation

    1m 6s
  • (Locked)
    Malicious login profile update

    1m
  • (Locked)
    Malicious privileged role assignment

    41s
• 6. Investigating Storage Threats 6. Investigating Storage Threats

  • (Locked)
    S3 bucket enumeration

    1m 25s
  • (Locked)
    S3 bucket versioning modification

    1m 9s
  • (Locked)
    S3 bucket policy modification

    51s
  • (Locked)
    S3 object exfiltration

    42s
  • (Locked)
    S3 object deletion

    49s
• 7. Investigating Logging and Monitoring Threats 7. Investigating Logging and Monitoring Threats

  • (Locked)
    CloudTrail logging stopped

    1m 4s
  • (Locked)
    CloudTrail trail deletion

    47s
• 8. Amazon GuardDuty 8. Amazon GuardDuty

  • (Locked)
    Detecting AWS threats with GuardDuty

    35s
• Conclusion Conclusion

  • (Locked)
    Learning more about AWS security

    56s