Nosy Nimbus

Cloud

Estimated Time

Difficulty

Easy

Point Value

Query Languages

SPL

Part of Pathway

Cloud Catastrophe

The morning started like any other at Nimbus Technologies, a growing startup with a substantial AWS footprint. Their monitoring dashboard suddenly lit up with alerts—unusual login patterns, unexpected API calls, and resource changes nobody authorized.

6 Techniques

Challenge Description

After getting access to Nimbus Technologies AWS account, the attacker likely performed actions to figure out more details about their surroundings. Narrow down what information they gained, so you know where to pivot as well.

Log Source Types

AWS CloudTrail

MITRE ATT&CK Techniques

T1087.004 Account Discovery: Cloud Account

T1069.003 - Permission Groups Discovery: Cloud Groups

T1538 - Cloud Service Discovery

Getting Started

Review the challenge description and log types

Click "Start Challenge" to begin your investigation

Ready to start the challenge?

Head to the workspace to begin solving