VPN You Later

Cloud

Desktop Recommended

This SPL/SIEM challenge is optimized for desktop computers. For the best experience with complex queries and data analysis, we recommend using a larger screen.

Estimated Time

35

Difficulty

Medium

Point Value

20

Query Languages

SPL

Cloud Catastrophe
Part of Pathway

Cloud Catastrophe

The morning started like any other at Nimbus Technologies, a growing startup with a substantial AWS footprint. Their monitoring dashboard suddenly lit up with alerts—unusual login patterns, unexpected API calls, and resource changes nobody authorized.

6 Techniques

Challenge Description

You're diving deeper into this incident at Nimbus Technologies. You need to understand what the attacker did after gaining access to the environment. What's their next move?

Log Source Types

AWS CloudTrail

MITRE ATT&CK Techniques

T1087.004 - Account Discovery: Cloud Account
T1069.003 - Permission Groups Discovery: Cloud Groups
T1538 - Cloud Service Discovery

Getting Started

1

Sign in or create an account to begin the challenge

2

Review the challenge description and log types

3

Click "Start Challenge" to begin your investigation

Ready to start the challenge?

Head to the workspace to begin solving