Cloud Catastrophe
The morning started like any other at Nimbus Technologies, a growing startup with a substantial AWS footprint. Their monitoring dashboard suddenly lit up with alerts—unusual login patterns, unexpected API calls, and resource changes nobody authorized.
Your Progress
0% Complete
Pathway Introduction
As Nimbus' newly hired security analyst, you've been tasked with investigating this potential breach. The CTO is breathing down your neck while the company's critical cloud infrastructure and sensitive customer data hang in the balance.
Using your SPL skills and cloud security knowledge, you'll need to trace the attacker's path through CloudTrail logs, determine what systems were compromised, assess potential data exfiltration, and identify unauthorized infrastructure changes.
Time is of the essence—every minute the attacker remains in the environment, they could be accessing more sensitive data or setting up persistent backdoors. Your mission: follow the digital breadcrumbs, understand the scope of the breach, and provide the intelligence needed to stop the attack and begin recovery.
Are your cloud forensics skills up to the challenge? Dive into the logs and find out!
Pathway Chapters
Chapter 1: When It Rains, It Pours
Discover the initial signs of the breach by investigating unusual login patterns and access key exposures.
Chapter 2: Storm Chasers
Track the attacker's reconnaissance activities and attempts to escalate privileges within the AWS environment.
Chapter 3: Weather the Storm
Identify data exfiltration attempts and infrastructure changes made to increase the monetary value of the breach for the attackers.
Related MITRE ATT&CK Tactics
Initial Access
Techniques that adversaries use to gain their initial foothold within a network or system.
Privilege Escalation
Techniques that adversaries use to gain higher-level permissions on a system or network.
Discovery
Techniques that adversaries use to gain knowledge about the system and internal network.
Collection
Techniques adversaries use to gather information and the data they're after as part of their mission.
Exfiltration
Techniques that adversaries use to move data from a system to an external system.
Impact
Techniques that adversaries use to cause damage to a system or network.
Chapter Progress
Chapter 1: When It Rains, It Pours
Discover the initial signs of the breach by investigating unusual login patterns and access key exposures.
Chapter 2: Storm Chasers
Track the attacker's reconnaissance activities and attempts to escalate privileges within the AWS environment.
Pathway Stats
Prerequisites
- A basic understanding of SPL
- Familiarity with AWS API Commands
- A basic understanding of networking concepts