AWS

AWS investigations centre on CloudTrail. Management events are visible for 90 days by default, but a trail is needed for durable retention, and data events (S3 object access, Lambda invokes) plus VPC/network logs are off until enabled - the usual blind spots for exfiltration scope. Identity events are global and land in us-east-1. GuardDuty, Config, and Athena over CloudTrail-in-S3 are the workhorses for detection and query.

Cheat sheet by domain Threat matrix Incident response plan Historical incidents & TTPs

Cheat sheet by domain

Status: Enabled by default Partial / mixed OFF - must enable

Domain	What is included	Key logs	On by default?	How to obtain	Example ATT&CK
Identity & Access	Human + non-human identities, sign-in / authentication, MFA, federation & SSO trust, role/permission grants, OAuth app consent, token & session activity. Covers credential/session revocation and non-human identity (NHI) inventory.	IAM Identity Center sign-in logs CloudTrail IAM events (CreateUser, AttachPolicy) IAM Credential Report (point-in-time) IAM Access Analyzer STS AssumeRole events (CloudTrail)	Partial / mixed	Request read-only CloudTrail + Identity Center sign-in logs; ask client to export IAM Credential Report via script (aws iam generate-credential-report). Revoke: delete-access-key; revoke active role sessions (deny-all + aws:TokenIssueTime). Access Analyzer requires enable.	T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1550.001 App Access Token, T1110.003 Password Spraying, T1556 Modify Auth Process
Control Plane & Management Activity	All management-plane API activity (Console/GUI, CLI, SDK). Audit-log architecture, log-tampering & immutability, resource/config changes, org-policy and tenant hierarchy changes, service enumeration.	CloudTrail (management events) CloudTrail Insights (anomaly) AWS Config (resource changes) GuardDuty (anomaly detection) CloudWatch Logs (forwarded)	Enabled by default	Management events ON (90d default) - ask client to export & upload securely (Box/Aspera) or grant read-only CloudTrail/CloudWatch. Data events & Insights are OFF - request enable. GuardDuty also requires enable (not on by default). Athena to query CloudTrail in S3.	T1562.008 Disable Cloud Logs, T1526 Cloud Service Discovery, T1580 Cloud Infra Discovery, T1651 Cloud Admin Command, T1666 Modify Resource Hierarchy
Workloads & Runtime	Compute & runtime: VMs, serverless, containers/Kubernetes. Instance metadata (IMDS) access, runtime threat detection, image trust, cryptojacking / resource hijacking, lateral movement to hosts.	CloudWatch Logs agent (system/app) EKS audit + control-plane logs GuardDuty Runtime Monitoring AWS Config (resource changes) VPC Flow (IMDS pivot correlation)	OFF - must enable	Agent logs & GuardDuty Runtime are OFF - request enable. Ask client to export a snapshot or attach EBS volume to a forensic VM for investigation. Enforce IMDSv2 (modify-instance-attribute). Athena for stored logs.	T1496.001 Compute Hijacking (EC2), T1552.005 Cloud Instance Metadata API, T1578.001 Create Snapshot, T1648 Serverless Execution, T1204.003 Malicious Image
Network & Connectivity	Ingress/egress & lateral traffic: VPC flows, DNS, load balancers, WAF, firewall rules. Edge exploitation, C2/tunnelling, DDoS, exfil-over-network detection.	VPC Flow Logs (NetFlow) VPC Traffic Mirroring (PCAP) Route 53 Resolver query logs Load Balancer (ELB/ALB) access logs WAFv2 logs	OFF - must enable	VPC Flow, Route 53 query, WAFv2 & ELB logs are OFF by default - ask client to enable & export, or grant CloudWatch/S3 read. SG changes are tracked in CloudTrail. Block: modify-security-group-rules / wafv2 update-ip-set.	T1190 Exploit Public-Facing App, T1071 App Layer Protocol (C2; network/endpoint technique - outside Cloud matrix), T1048 Exfil Alt Protocol, T1498 Network DoS, T1046 Network Service Discovery
Data Services & Storage	Object/blob storage, databases, data warehouses, key-management. Data-plane (object-level) logging, cross-account shares, snapshots, immutable backups, mass-read / ransomware / destruction.	S3 Server Access Logs CloudTrail S3 Data Events KMS audit (via CloudTrail) RDS audit logs EBS snapshot-share events	OFF - must enable	S3 server-access & data events OFF - request client enable per Tier-1 bucket & export securely. KMS events ON via CloudTrail. If ingested, grant CloudWatch read. Restore from versioned/Object-Lock buckets.	T1530 Data from Cloud Storage (S3), T1619 Cloud Storage Object Discovery, T1537 Transfer Data to Cloud Account, T1485 Data Destruction, T1486 Data Encrypted for Impact
DevSecOps & Pipelines	CI/CD pipelines, source repos, artifact registries, secrets in build. OIDC/federated build identities, supply-chain & dependency tampering, malicious workflow, pipeline secret theft.	CodePipeline/CodeBuild logs Secrets Manager audit (CloudTrail) GitHub Actions audit log Lambda function + deploy logs CloudTrail role-assumption (OIDC)	Partial / mixed	Pipeline & Secrets Manager events ON via CloudTrail/CloudWatch - request read or export. GHAS scanning OFF. Revoke CI OIDC trust; rotate secrets; halt pipeline (put-approval-result --deny).	T1195 Supply Chain Compromise, T1677 Poisoned Pipeline Execution, T1552.001 Credentials In Files, T1213.003 Code Repositories, T1098.001 Additional Cloud Credentials
SaaS & Collaboration Platforms	SaaS & collaboration: M365 / Google Workspace / Okta / GitHub org. Mailbox & file audit, OAuth-app abuse, inbox/forwarding rules, refresh-token replay, helpdesk-reset abuse.	IdP sign-in logs (external) SES sending / bounce logs CloudTrail SSO federation events (See SaaS tab for M365/GWS/Okta)	Partial / mixed	Primarily covered under SaaS platforms. For AWS: audit SAML/OIDC federation trust in CloudTrail; revoke external IdP session; check SES for outbound abuse.	T1566 Phishing, T1114.003 Email Forwarding Rule, T1671 Cloud Application Integration, T1528 Steal App Access Token, T1496.003 SMS Pumping (SNS)
AI/ML Services	Managed AI/ML: model invocation, training-data buckets, inference endpoints, guardrails. Model/data exfil, prompt injection, abuse of stolen API keys (detect via cost anomalies), poisoning.	Bedrock Model Invocation Logging Bedrock/Cost Anomaly Detection SageMaker audit (CloudTrail) SageMaker feature-store access	OFF - must enable	Model Invocation Logging OFF - request enable to CloudWatch/S3. Cost Anomaly auto-configured only if Cost Explorer was first enabled after Mar 2023 (default AWS Services monitor); otherwise create a monitor. Revoke API keys on InvokeModel spike; audit training-data bucket reads; cancel ScheduleKeyDeletion on AI KMS key.	T1496.004 Cloud Service Hijacking, T1657 Financial Theft (token/cost), T1530 Data from Cloud Storage (training data), T1567 Exfil Over Web Service; also MITRE ATLAS AML.T0019 Model Exfiltration

Threat matrix

Adversary behaviours most relevant to each domain, and the log that first reveals them. Cross-check IDs against the live ATT&CK Cloud matrices.

Domain	Example adversary behaviours (ATT&CK)	Primary detection log
Identity & Access	T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1550.001 App Access Token, T1110.003 Password Spraying, T1556 Modify Auth Process	IAM Identity Center sign-in logs
Control Plane & Management Activity	T1562.008 Disable Cloud Logs, T1526 Cloud Service Discovery, T1580 Cloud Infra Discovery, T1651 Cloud Admin Command, T1666 Modify Resource Hierarchy	CloudTrail (management events)
Workloads & Runtime	T1496.001 Compute Hijacking (EC2), T1552.005 Cloud Instance Metadata API, T1578.001 Create Snapshot, T1648 Serverless Execution, T1204.003 Malicious Image	CloudWatch Logs agent (system/app)
Network & Connectivity	T1190 Exploit Public-Facing App, T1071 App Layer Protocol (C2; network/endpoint technique - outside Cloud matrix), T1048 Exfil Alt Protocol, T1498 Network DoS, T1046 Network Service Discovery	VPC Flow Logs (NetFlow)
Data Services & Storage	T1530 Data from Cloud Storage (S3), T1619 Cloud Storage Object Discovery, T1537 Transfer Data to Cloud Account, T1485 Data Destruction, T1486 Data Encrypted for Impact	S3 Server Access Logs
DevSecOps & Pipelines	T1195 Supply Chain Compromise, T1677 Poisoned Pipeline Execution, T1552.001 Credentials In Files, T1213.003 Code Repositories, T1098.001 Additional Cloud Credentials	CodePipeline/CodeBuild logs
SaaS & Collaboration Platforms	T1566 Phishing, T1114.003 Email Forwarding Rule, T1671 Cloud Application Integration, T1528 Steal App Access Token, T1496.003 SMS Pumping (SNS)	IdP sign-in logs (external)
AI/ML Services	T1496.004 Cloud Service Hijacking, T1657 Financial Theft (token/cost), T1530 Data from Cloud Storage (training data), T1567 Exfil Over Web Service; also MITRE ATLAS AML.T0019 Model Exfiltration	Bedrock Model Invocation Logging

Incident response plan

Get read-only access via an assumed IR role; run aws sts get-caller-identity and record it.
Check logging posture: is a multi-region trail on, are data events and VPC flow logs enabled, is Config recording.
Preserve now: export CloudTrail/S3 access logs; snapshot affected EBS volumes; copy GuardDuty findings.
Scope identity: review IAM, STS AssumeRole chains, access keys; use Access Analyzer and CloudFox.
Contain: aws iam delete-access-key / update-access-key --status Inactive, detach policies, revoke active role sessions (deny-all + aws:TokenIssueTime), rotate secrets.
Recover and harden: enforce IMDSv2, enable data events/flow logs, restore from Object-Lock/versioned buckets.

Historical incidents & TTPs

Publicly-reported incidents and techniques. Attribution reflects vendor/government assessments; some entries are disclosed vulnerabilities or SaaS/OAuth cases rather than platform-native breaches.

Capital One (Paige Thompson)2019

SSRF against a misconfigured WAF reached the EC2 metadata service, stole over-permissioned IAM role credentials, and exfiltrated ~106M records from S3. The case that drove IMDSv2.

T1190T1552.005T1078.004T1580T1530

Source

Code Spaces2014

Attacker gained AWS console access, created backup admin logins, and mass-deleted EBS/S3/AMIs when the company resisted. Backups were in the same account - the company shut down.

T1078.004T1136.003T1485T1490

Source

Uber2016

Hardcoded AWS keys in a private GitHub repo were used to pull an S3 archive on ~57M riders/drivers; the breach was concealed.

T1552.001T1213.003T1078.004T1530

Source

LastPass2022

A DevOps engineer's home machine was compromised, keylogging the master password past MFA to steal AWS S3 backup and decryption keys, exposing encrypted customer vaults.

T1078.004T1555T1056.001T1530

Source

TeamTNT cryptojacking worm2020-2023

Automated worms scanned exposed Docker/Kubernetes APIs, harvested AWS credentials from IMDS and ~/.aws/credentials, and deployed Monero miners. (Loose brand with copycats.)

T1190T1552.005T1552.001T1496T1610

Source

Scattered Spider / UNC39442022-present

Help-desk vishing and MFA fatigue hijack SSO identity, then abuse legitimate AWS access to enumerate and persist for extortion. ATT&CK group G1015.

T1566T1621T1078.004T1580T1219

Source

Codefinger S3 ransomware2025

Compromised AWS keys used to re-encrypt a victim's own S3 objects with attacker-supplied SSE-C keys AWS never stores - abuse of a legitimate feature, not a vulnerability.

T1078.004T1486T1490T1657

Source