Network forensics in AWS is not like network forensics on-premise. There's no physical switch to mirror traffic from. But AWS gives you powerful tools — VPC flow logs, load balancer logs, DNS resolver logs — that tell you a huge amount about what was happening on the network. VPC — Virtual Private Cloud A VPC is a logical network boundary inside AWS — like a network switch. Everything inside can communicate at Layer 3, nothing gets in or out without explicit routing and firew

When you're investigating a compromised cloud environment, the virtual machine is often where the real action happened. In AWS, virtual machines are EC2 instances, and their storage is handled by EBS volumes. Understanding how these work — and what evidence they leave in CloudTrail — is essential for any cloud IR investigation. ----------------------------------------------------------------------------------------------------- EC2 Instance Types — Why They Matter for IR T-se

Understanding the CloudTrail format is one thing. Actually using it to find attacker activity is another. n this article, we walk through the most common CloudTrail investigation scenarios — tracking who logged into the console, detecting new API keys being created, finding evidence of exposed keys being abused, and running proactive threat hunts. Scenario 1: Tracking Console Logins Console logins leave a specific CloudTrail footprint. The event is called ConsoleLogin from ev

If there's one log source you need to master for AWS investigations, it's CloudTrail. Every API call made in your AWS environment — whether it's someone logging into the console, a Lambda function creating a storage bucket, or an attacker enumerating your IAM roles — gets recorded here. This is your event log for the cloud. ------------------------------------------------------------------------------------------------------------- What CloudTrail Actually Is ▸ Default: 90 da

If you've ever walked into an AWS incident and felt like the engineers around you were speaking a completely different language — you're not alone. AWS has its own vocabulary, its own structure, and its own quirks. Before you can even begin to scope an investigation, you need to understand what you're actually dealing with. Think of this article as your field translator. We're going to walk through how AWS is organised, how identity works, and the different ways someone — leg