Incident Response in the AWS cloud
- Buy now
- Learn more
- Course Resources
- Course References
- AWS CloudTrail CheatSheet
- Athena Cheat Sheet
Welcome

Course Introduction
Lab 1.0 - Getting Started

Lab 1.0 - Instructions
Lab 1.0 - Walkthrough (with solutions)
Introduction

Course Roadmap & Structure
AWS Basics

AWS Hierarchy
IAM Users & Groups
IAM - Policies
IAM - Roles
Demo - Switching a role
Demo - Assuming a role
IAM - Roles for IR
IAM - Access Analyzer for IR
Commonly attacked services
Lab 1.1 - Exploring AWS

Lab 1.1 - Instructions
Lab 1.1 - Walkthrough (with solutions)
AWS Security

AWS security services - Overview
Amazon GuardDuty
Amazon Inspector
Amazon Detective
AWS Security Hub
AWS Security Lake
Lab 1.2 - Investigating a security alert

Lab 1.2 - Instructions
Lab 1.2 - Walkthrough (with solutions)
AWS Threats

AWS Incidents & Common Threats
Common Threats - IAM & S3
Common Threats SES & Kubernetes
Threat Framework overview & MITRE
Hacking The Cloud
Stratus Red Team
Demo: Simulate attacks with Stratus Red Team
AWS Attack tools

Overview & Prowler
Demo - Prowler
CloudFox
Other tools
AWS Forensics - Log overview

AWS Forensics - Overview
Approach & Process
AWS Log overview
Log strategy
AWS Forensics - Log acquisition

Log acquisition
Lab 1.3 - Determining log availability

Lab 1.3 - Instructions
Lab 1.3 - Walkthrough (with solutions)
AWS Forensics - Log processing

Log destinations
CloudWatch
Athena
Security Lake
OpenSearch
Conclusion
AWS Forensics - Log analysis

Cloud native options in AWS
Option 1 - Athena
Option 2 - OpenSearch
Option 3 - CloudWatch
Lab 1.4 - Using Athena for log analysis

Lab 1.4 - Instructions
Lab 1.4 - Walkthrough (with solutions)
AWS Forensics - Log analysis (CloudTrail)

Overview & Event Types
Configuring Trails
(Advanced) Event Selectors
Management Events - contents
CloudTrail analysis - eventName
CloudTrail Cheatsheet
CloudTrail analysis - userIdentity
CloudTrail analysis - requestParameters & responseElements
CloudTrail analysis - Other fields
Data Events - Overview
Data Events vs. S3 access logs
CloudTrail Data events - Analysis
S3 access logs - Analysis
Insights Events
CloudTrail analysis - Tips
Cloudtrail analysis - wrap-up
Lab 1.5 - Investigating your first AWS incident

Lab 1.5 - Instructions
Lab 1.5 - Walkthrough (with solutions)
AWS Forensics - Log analysis (VPC flow logs)

VPC Introduction
VPC Flow logs
VPC Flow logs in Athena
VPC Flow logs - Analysis
AWS Forensics - Log analysis (Other logs)

Route 53 logs - Analysis
Load Balancer logs - Analysis
AWS Forensics - Host forensics

Host Forensics - EC2 & Containers
Host Forensics - SSM
Host Forensics - Using Cado
Bonus Lab - Using Cado for cloud incident response

Bonus lab - Instructions
Bonus lab - Walkthrough (with solutions)
AWS Attacks

Attack Introduction & Phases
AWS Attacks - Part I

Initial Access
Discovery
Execution
Lab 1.6 - AWS Attacks Part I

Lab 1.6 - Instructions
Lab 1.6 - Walkthrough (with solutions)
AWS Attacks - Part II

Privilege Escalation
Persistence
Defense Evasion
Lab 1.7 - AWS Attacks Part II

Lab 1.7 Instructions
Lab 1.7 - Walkthrough (with solutions)
AWS Attacks - Part III

Credential Access
Lateral Movement
Collection
Impact
Exfiltration
Lab 1.8 - AWS Attacks Part III

Lab 1.8 Instructions
Lab 1.8 - Walkthrough (with solutions)
Cloud Incident Response Process

On-premise vs. Cloud IR
Cloud Incident Response Process
Prepare
Detection & Analysis
Contaiment, Eradication & Recovery
Post-Incident Activity
Cloud Incident Case Study #1 - Ransomware

Case Study - Ransomware
Cloud Incident Case Study #2 - Long compromise

Case Study - Longer Compromise
Capture the Flag (CTF) - Competition

Mad Men (CTF) - Instructions
Mad Men (CTF) - CTF Password
Welcome to crypto (CTF) - Instructions
Welcome to crypto (CTF) - CTF password
Course wrap-up

Wrap-up & Next steps
Certificate of Completion - Request

Request certificate

Bonus Lab - Using Cado for cloud incident response

2 Lessons