aws on logsec https://www.logsec.cloud/tags/aws/ Recent content in aws on logsec Hugo -- gohugo.io Thu, 01 Sep 2022 00:00:00 +0000 Configure cross-account access from an EC2 Instance to an AWS CodeCommit repo using roles https://www.logsec.cloud/posts/cross-account-access-codecommit-repo/ Thu, 01 Sep 2022 00:00:00 +0000 https://www.logsec.cloud/posts/cross-account-access-codecommit-repo/ Step-by-step IAM role setup that lets an EC2 instance in one AWS account clone and push to a CodeCommit repo in another account. Investigating CloudTrail Logs using ELK Stack https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Tue, 20 Apr 2021 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Seven Kibana (KQL) queries for spotting suspicious AWS CloudTrail activity, from disabled logging to backdoor access keys, mapped to MITRE ATT&CK. Splunk Attack Range on AWS - Guide https://www.logsec.cloud/posts/splunk-range-setup/ Fri, 02 Oct 2020 00:00:00 +0000 https://www.logsec.cloud/posts/splunk-range-setup/ Notes and fixes for building Splunk Attack Range on AWS, then simulating Zerologon (CVE-2020-1472) against the lab domain controller. dnscat2: Command and Control over the DNS https://www.logsec.cloud/posts/dnscat2-demo-on-aws/ Sat, 15 Aug 2020 00:00:00 +0000 https://www.logsec.cloud/posts/dnscat2-demo-on-aws/ Set up dnscat2 across two AWS accounts to see how attackers tunnel command-and-control over DNS, and how to defend against it. Detect Public S3 Bucket using Splunk https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Sat, 20 Jun 2020 00:00:00 +0000 https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Splunk searches over CloudTrail logs that catch S3 buckets made public through the console, canned ACLs or grant flags, plus how to respond and prevent it. Investigating S3 Scanning Activities on AWS https://www.logsec.cloud/posts/investigating-on-aws/ Thu, 04 Jun 2020 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-on-aws/ Investigating unknown AWSConfig requests against S3 buckets, reproducing them in a lab, and how AWS Config could be used to check whether a bucket exists. Ingest VPC Flow Logs with Additional Meta-Data to Splunk https://www.logsec.cloud/posts/ingest-vpc-flow-logs-to-splunk/ Fri, 01 May 2020 00:00:00 +0000 https://www.logsec.cloud/posts/ingest-vpc-flow-logs-to-splunk/ Create VPC Flow Logs with extra metadata fields using Terraform, ship them to Splunk through S3 and SQS, and update props.conf to parse the new fields. Ingest AWS CloudTrail logs to Splunk https://www.logsec.cloud/posts/ingest-cloudtrail-logs-to-splunk/ Mon, 20 Apr 2020 00:00:00 +0000 https://www.logsec.cloud/posts/ingest-cloudtrail-logs-to-splunk/ Build a Splunk lab on AWS with Terraform and ingest CloudTrail logs through S3 and SQS using the Splunk Add-on for AWS.