Breach at flaws.cloud: CloudTrail Investigation
Breach at flaws.cloud: CloudTrail Investigation
Real CloudTrail logs from a real attacked AWS account. Trace a leaked key, a stolen EC2 role and an IAM recon session, event by event.
Briefing
flaws.cloud was a real AWS account built as a training target, and thousands of people attacked it between 2017 and 2020. Its creator, Scott Piper, published the account's CloudTrail logs (anonymised) for research.
You have three hours of those real logs: 30 July 2019, 20:30 to 23:30 UTC, 3,520 records exactly as exported.
An alert fired: the credentials of the EC2 instance role "flaws" were used from outside AWS. You are the responder. Work out who did what, with which keys, and what they were after.
Topics you practise
Evidence
cloudtrail-flaws-2019-07-30.json.gz
CloudTrail records in the standard {"Records": [...]} format, gzip compressed. (115 KB (2.9 MB unzipped))
Source: Summit Route: public dataset of CloudTrail logs from flaws.cloud. Released publicly for research by Scott Piper (anonymised IPs and keys).
Suggested tools: jq, Python (json or pandas), Excel or LibreOffice (Power Query), Amazon Athena (optional), the viewer on this page.
How many unique events does the file contain once duplicate records are removed by eventID?
Format: a number.
Which source IP address used the credentials of the "flaws" role?
Format: an IPv4 address.
Which EC2 instance did those stolen credentials come from? Enter its instance ID.
Format: i-... (as it appears in the log).
The stolen access key ID begins with a four-letter prefix that marks it as temporary STS credentials. What is the prefix?
Format: four letters.
Before touching the role, the same IP used a long-term key. Which IAM user did that key belong to?
Format: the IAM user name.
Enter that user's access key ID. It is the indicator you would search for across every account and log source.
Format: the 20-character key ID.
With that key, one API call was made far more often than any other. How many unique times was it called?
Format: a number (unique events).
Across how many AWS regions did those calls run?
Format: a number.
The user agent shows where the attacker ran the AWS CLI. Which operating system was it?
Format: the OS name.
Using the Level6 user, the attacker read one customer-managed policy document. Which policy, and which version?
Format: policyname:version.
The policy pointed to API Gateway. Which REST API ID did the attacker query?
Format: the API ID.
A second actor attacked Level6 in the same window with an automated Python tool. Which penetration-testing Linux distribution was it running?
Format: the distribution name.
Which MITRE ATT&CK sub-technique covers stealing credentials from the cloud instance metadata API?
Format: T####.###.
Each task is worth 100 points: minus 15 per wrong answer and 25 for a hint (never below 40). Finish when you are done; 13 unsolved tasks score 0. Your progress is saved on this device.