This note documents detection patterns related to AWS Account & Cloud Resource Abuse using CloudTrail and supporting telemetry.

Cloud attacks are not about binaries — they are about identity and API abuse.

Authentication → Identity Abuse → Privilege Escalation → Resource Access → Exfiltration → Cleanup

---

Triage with Splunk

# Install
docker pull splunk/splunk:latest

# Start (LOCALHOST ONLY - SAFE)
docker run -d --name splunk `
-p 127.0.0.1:8000:8000 `
-p 127.0.0.1:8089:8089 `
-e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com `
-e SPLUNK_START_ARGS=--accept-license `
-e SPLUNK_PASSWORD="password" `
splunk/splunk

# Stop / Cleanup (burn after use mindset)
docker stop splunk  
docker start splunk  
docker rm splunk

---

Normalize JSON Records

# CloudTrail stores multiple events inside Records[]
# MUST flatten or Splunk will break parsing

# For non-compressed logs
find CloudTrail/ -name '*.json' -exec cat {} + | jq -c '.Records[]' > cloudtrail.json

# For .gz logs 
find CloudTrail/ -name '*.json.gz' -exec zcat {} + | jq -c '.Records[]' > cloudtrail.json

---

Ingest with Splunk

# Enable delete (useful during iteration)
"Settings" -> "Roles" -> "admin" -> Tick "can_delete"

# Copy logs into container
docker cp TARGET_LOGS/ splunk:/

# Verify container
docker exec -it splunk bash

# Add data (IMPORTANT: ignore Digest logs)
"Home" -> "Add Data" -> "Monitor" -> "(Files & Directories)" -> "Finish"

# Timestamp Fix (CloudTrail = UTC)
"Timestamp" -> "Advanced" ->
    "Time zone" = "GMT"
    "Timestamp format" = "%Y-%m-%dT%H:%M:%SZ"
    "Timestamp fields" = "eventTime"

# Prevent truncation of JSON
"Advanced" -> "New setting" ->
    "TRUNCATE" = "0"

"Save As" -> "CloudTrail"

# Reset index during testing
* | delete

---

Key Fields

---

Direct Indicators

---

Indirect Indicators (Behavioral Detection)

---

Quick Triage Queries

General

# Active Identities
index=* userIdentity.type!="AWSService"  
| stats count by userIdentity.userName  
| sort -count

# Source IP
index=*  
| stats count by sourceIPAddress  
| sort -count

# User Agent
index=*  
| stats count by userAgent
| sort -count

# Full Timeline
index=* userIdentity.type!="AWSService"  
| eval _time=strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ")  
| table _time userIdentity.userName eventName sourceIPAddress  
| sort _time

Scrutiny

# On bucket
* requestParameters.bucketName="forela-fileshare"
| table eventName, _time, sourceIPAddress, userIdentity.arn
| sort _time

# By denied access failures
* sourceIPAddress="54.242.59.197" errorCode=AccessDenied
| table eventName, _time, userAgent, userIdentity.arn
| sort _time

---

Common Tools / Tradecraft

---

Relevant Artifacts

Cloud Logs

• CloudTrail (PRIMARY)
• CloudTrail Insights (anomaly detection)
• CloudWatch Logs

IAM

• Users, Roles, Policies
• Access keys (active/inactive)
• Trust relationships

Storage (S3)

• Object access logs
• Bucket policies
• Public exposure settings

Compute (EC2)

• Instance metadata
• Security groups
• AMI usage

Network

• VPC Flow Logs
• Public IP activity
• Security group changes

Other

• AWS Config (resource changes)
• GuardDuty findings
• Route53 DNS logs

---

Decision Tree

1. Was there a login?

   • ConsoleLogin
   • MFA used?
   • Source IP expected?

2. Identity abused?

   • CreateAccessKey
   • CreateUser
   • AssumeRole

3. Privilege escalation?

   • AttachUserPolicy
   • PutUserPolicy
   • UpdateAssumeRolePolicy

4. Discovery?

   • ListUsers
   • ListBuckets
   • GetCallerIdentity

5. Resource abuse?

   • RunInstances
   • S3 access (GetObject)

6. Defense evasion?

   • DeleteTrail
   • StopLogging

7. Timeline correlation

   • Login → IAM → Resource → Exfil

---

Attack Patterns

Credential Abuse + Exfil

GetCallerIdentity
→ ListBuckets
→ ListObjects
→ GetObject (mass)

Privilege Escalation via Policy

ListPolicies
→ GetPolicyVersion
→ SetDefaultPolicyVersion
→ AttachUserPolicy (Admin)

Lambda-Based Execution (Stealth)

CreateFunction
→ PassRole
→ Invoke
→ GetObject / IAM actions

Persistence via IAM

CreateUser
→ CreateAccessKey
→ AttachUserPolicy (Admin)

Defense Evasion

ListDetectors
→ DeleteDetector
→ DescribeLogGroups
→ DeleteLogGroup
→ StopLogging

---

MITRE ATT&CK References

• T1078 Valid Accounts
• T1098 Account Manipulation
• T1069 Permission Groups Discovery
• T1087 Account Discovery
• T1021 Remote Services (via AssumeRole)
• T1530 Data from Cloud Storage
• T1485 Data Destruction
• T1562 Impair Defenses