SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection

Overview

SEC541 starts with an investigation into the attack of the developer services company, Code Spaces. The class will break down the attack and map each action to the MITRE ATT&CK framework.

This leads to an investigation of the detection and logging capability most unique to Cloud Services, the Cloud API Service. The Cloud API is at the heart of most activity in the cloud and is the first best place to start for analysis and detection.

The class then investigates network analysis options in AWS and Azure cloud services, understanding what data is available, what is missing, and some of the ways that network analysis could have been used to detect Code Spaces and similar attacks.

Exercises

• SEC541 Environment Deployment
• Analyzing Cloud API logs with CloudTrail
• Parsing JSON-Formatted Logs with JQ
• Network Analysis

Topics

Debrief: Code Spaces

• Walkthrough of the attack on the developer services company, Code Spaces
• Understanding threat-focused detection and analysis
• MITRE ATT&CK

Cloud API Logging

• Cloud API Logging overview
• AWS CloudTrail service
• Azure Activity Log
• Log Parsing with JQ

Cloud-Native Logging Services

• AWS CloudWatch logging
• CloudWatch Insights for analytics
• Azure Log Analytics

Network Flow Logging

• AWS VPC Flow Logs
• AWS Athena
• Azure Flow Logs

Overview

Section 2 starts with a dive into the attack against Tesla's Kubernetes management services. As with Section 1, the class will investigate the specific tactics used in the attack and how they map to MITRE's new Container ATT&CK Framework.

Containers are becoming ever more common in cloud services, especially when they help common application development in multi-cloud or hybrid architectures. Section 2 starts with looking at how application logs can be gathered in AWS and Azure, at what level, and the types of data typically gathered. The class then looks at Kubernetes, Docker, AWS, and Azure container orchestration services, what data is logged, and how to investigate that log data to detect activity or help with investigations.

The section rounds out by looking at proxies that operate in the cloud environment. Proxies have the promise of improving operations and maybe even security, but Cloud-managed proxies lose some visibility. The class will understand what services are available and how to make the most of the logging.

Exercises

• Section 2 environment setup
• Application/OS log lab with OpenCanary
• CloudWatch agent and customization
• Strange ECS behavior
• Finding data exfiltration

Topics

Debrief Tesla Attack

• Story Overview
• Introduce MITRE Container Matrix
• Discuss Threats to Container-based Deployments

Making use of Operating System Logs

• Windows operating system logs
• Powershell logs
• Linux logging

Gathering Application Generated Logs

• Web server logs
• Database logs
• Honeypots

Log Agents

• AWS CloudWatch Agent
• Azure Log Analytics Agent

Container Logs

• Docker logging
• Kubernetes logging
• AWS ECS (EC2 and Fargate)
• AWS EKS (EC2 and Fargate)
• Azure Container Instances
• Azure AKS

Cloud Proxies

• AWS proxy services
• Azure proxy services
• Content Delivery Networks
• Storage access logs

Overview

Section 3 starts with an investigation into the Capital One attack. After pulling apart the techniques used by the attacker, the class will look at how AWS cloud's metadata service can be used to gain unauthorized access to cloud infrastructure through application vulnerabilities, and what is different from Azure's implementation.

After a discussion of AWS services that help with security monitoring, the section will discuss tools and cloud-managed services that are used to perform an inventory of resources and perform data discovery. Cloud environments are constantly changing, and the investigator needs these discovery tools to pinpoint problems quickly.

AWS and Azure provide services to help with application, host, and configuration vulnerabilities that may point to potential intrusion and attacker activities. The class will look at some cloud company services build to help perform and remediate these vulnerabilities.

Lastly, this section will discuss the benefits of centralizing the data collected from cloud, host, and application logs. The class will look at AWS and Azure services that help manage data centralization, which one to use, and their benefits.

Exercises

• Metadata services and GuardDuty
• Cloud Inventory
• Discovering sensitive data in unapproved location with Macie
• Vulnerability assessment with Inspector
• Data Centralization with Graylog

Topics

Debrief: Capital One

• Story Overview
• AWS and Azure metadata services
• AWS GuardDuty Overview

AWS Cloud Inventory Techniques and Services

• Command Line Discovery
• AWS Configuration
• Inventory with Azure

Using Data Discovery Tools

• Hunting data in cloud services
• AWS System Manager
• AWS Macie
• Azure cognitive search

Vulnerability Analysis Services

• AWS Inspector
• AWS Security Hub
• Azure Security Center
• AWS ECR

Data Centralization

• AWS Event Bus
• AWS Kinesis Data Firehose

AWS Elasticsearch

Overview

Just like the first three sections, section 4 starts off with a review of the MalwareBytes breach from early 2021 and the major MITRE ATT&CK techniques involved. Afterwards, we will explore Microsoft 365, the components aiding defenders in their detection initiatives, and put our skills to the test using those techniques to discover the beginning of a new attack campaign in the first of five lab exercises.

Next, and this is where section 4 differs, we will review a second breach: the SolarWinds supply chain attack from 2021. Afterwards, we dive more deeply into the Microsoft Azure ecosystem by learning the artifacts left behind - and the proper configuration steps - of Azure Active Directory. This will include a lab analyzing data using a language that was covered previously (but not yet exercised): Kusto Query Language.

You will find, in the next few modules that round out the section, a continuation of what makes Azure quite different than most other cloud vendors: how their logging is handled related to cloud storage access, their unique detection services, and how network traffic can be analyzed. Each of these topics include a unique exercise to hone your skills.

Exercises

• Microsoft 365 Exchange Investigation
• Introduction to Kusto Query Language
• Log Analytics Analysis using Azure CLI
• Microsoft Defender for Cloud and Sentinel
• Azure Network Traffic Analysis

Topics

MalwareBytes Attack

• Story Overview

Microsoft 365

• Cloud productivity services discussion
• Microsoft 365 Admin Centers
• Microsoft Graph

SolarWinds Attack

• Story Overview

Azure Active Directory (AD)

• MITRE ATT&CK Azure AD Matrix
• Azure AD Overview
• Inventory of users and roles
• Azure AD logging approaches
• Analyze attacks against Azure AD

Storage Monitoring

• Overview of Azure Storage
• Attacks against cloud storage
• Analyzing Azure Storage logs and metrics

Detection Services

• Microsoft Defender of Cloud overview
• Microsoft Sentinel overview
• Continued discussion of cloud-specific threats
• Identifying these threats using Microsoft-provided detection services

Network Traffic Analysis

• Azure Network Security Group (NSG) Flow Logs
• Variable Packet Capture
• Analysis of network-based attacks against cloud infrastructure

Overview

The commercial cloud services are designed to automate the building and operation of complex workloads. We can leverage those automation design patterns to start automating the data capture, analysis, and security defenses in our environment. In this section, we will discuss some of the workloads we might want to automate in our cloud environment, investigate some of the services for automation, and then work through an example.

This section also includes a CloudWars competition to reinforce the topics covered throughout the course. Through this friendly competition, you will answer several challenges made up of multiple choice, fill-in-the-blank, as well as hands-on and validated exercises performed in two CSP environments. You will also be given new cloud resources to deploy and analyze - earning valuable points in the process.

Exercises

• Automated Response Actions
• CloudWars Challenge

Topics

Automated Response Actions

• Overview of automation services
• Lay out response actions we may want to automate
• Walk through an AWS automation example

CloudWars Challenge