AWS Exposed Access Key: Enumeration to Data Access
A deployment service account's AWS access key landed in a public GitHub repository. By the time the secret-scanning alert fired, an attacker had already validated the credential and was working through the account: mapping IAM identities, pulling financial exports from S3, and launching compute-optimized instances to mine cryptocurrency at the victim's expense. Work the CloudTrail audit trail and the SIEM to reconstruct the full chain.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establish when the key was exposed
15Before any CloudTrail event was written, something outside the organization's control flagged that a secret was in the open. Determine when the exposure was first detected.
Identify the compromised identity
15The key that was exposed belongs to a specific AWS IAM user. Trace the anomalous CloudTrail activity back to the identity that generated it.
Pin the attacker's first egress address
20The attacker drove the compromised identity from the internet. Identify the external address from which the credential was first validated.
Name the financial bucket accessed
20The attacker did not limit the intrusion to enumeration. A specific S3 bucket holding sensitive financial data was targeted for data collection. Identify it.
Classify the initial credential exposure technique
15The root cause of this incident is a specific category of credential insecurity. Map it to its MITRE ATT&CK sub-technique.
Find the compute resource the attacker provisioned
20The attacker did not stop at data collection. They pivoted to billing the victim for compute resources. Identify the EC2 instance launched during the attack.
Classify the compute abuse technique
15Map the attacker's use of victim compute resources for cryptomining to its MITRE ATT&CK technique.
7 tasks · 120 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allJenkins Arbitrary File Read: CVE-2024-23897 to RCE
The Jenkins controller at Vetrina Systems is running a version vulnerable to CVE-2024-23897 -- an args4j parser flaw that lets the CLI read any file from the server filesystem before authentication completes. An attacker used it to steal the Jenkins master key and credential store, decrypted stored service-account passwords offline, then authenticated and ran Groovy code through the Script Console to drop a persistent payload and pivot to connected build agents. Work from the SIEM access logs and XDR process evidence to trace every step from the first CLI probe to the reverse shell.
Entra ID Device Code Phishing: Token Theft
A Microsoft 365 user at a financial services firm receives a convincing phishing email asking her to enter a device code at the legitimate Microsoft devicelogin page. The code completes the attacker's OAuth request, handing over a valid token. Working through Entra sign-in logs, Graph audit events, and the email trail, trace how the token was stolen and what the attacker read from the victim's mailbox.
noPac: sAMAccountName Spoofing to Domain Admin
A low-privilege domain user creates a machine account, renames it to match a domain controller, and exploits a Kerberos principal-resolution flaw to obtain a domain-admin service ticket without ever holding elevated rights. Trace the two-CVE privilege escalation from the first LDAP rename event through to the credential harvest.