S3 (Simple Storage Service) is the backbone of AWS storage. It's where CloudTrail logs land, where flow logs are stored, where application data lives, and where attackers look for sensitive information. Understanding S3 from an IR perspective means understanding both how attacks happen against S3, and how S3 itself becomes your central evidence repository. S3 Access Controls — The Basics S3 access is controlled at multiple layers. Every S3 bucket is private by default — no pu

Network forensics in AWS is not like network forensics on-premise. There's no physical switch to mirror traffic from. But AWS gives you powerful tools — VPC flow logs, load balancer logs, DNS resolver logs — that tell you a huge amount about what was happening on the network. VPC — Virtual Private Cloud A VPC is a logical network boundary inside AWS — like a network switch. Everything inside can communicate at Layer 3, nothing gets in or out without explicit routing and firew

When you're investigating a compromised cloud environment, the virtual machine is often where the real action happened. In AWS, virtual machines are EC2 instances, and their storage is handled by EBS volumes. Understanding how these work — and what evidence they leave in CloudTrail — is essential for any cloud IR investigation. ----------------------------------------------------------------------------------------------------- EC2 Instance Types — Why They Matter for IR T-se

Understanding the CloudTrail format is one thing. Actually using it to find attacker activity is another. n this article, we walk through the most common CloudTrail investigation scenarios — tracking who logged into the console, detecting new API keys being created, finding evidence of exposed keys being abused, and running proactive threat hunts. Scenario 1: Tracking Console Logins Console logins leave a specific CloudTrail footprint. The event is called ConsoleLogin from ev

If there's one log source you need to master for AWS investigations, it's CloudTrail. Every API call made in your AWS environment — whether it's someone logging into the console, a Lambda function creating a storage bucket, or an attacker enumerating your IAM roles — gets recorded here. This is your event log for the cloud. ------------------------------------------------------------------------------------------------------------- What CloudTrail Actually Is ▸ Default: 90 da