Investigation labs

AWS WAF SQL Injection Attack Investigation

Cloud Detection & Response·Investigate a SQL injection campaign against a fictional e-commerce site using AWS WAF and ALB logs.

AWS WAF Cross-Site Scripting (XSS) Attack Investigation

Incident Response·Investigate a reflected XSS campaign against shop.lumenbay.io using CloudFront/WAF, ALB, and application logs.

EC2 Port Scanning Investigation

Incident Response·Investigate a GuardDuty port-probe finding against a fictional EC2 instance using VPC Flow Logs, security groups, and CloudTrail.

EC2 Suspicious DNS Communication Investigation

Incident Response·Investigate a GuardDuty Trojan:EC2/DriveBySourceTraffic!DNS finding using DNS query logs, VPC Flow Logs, Apache logs, and Linux process events.

AWS IAM Credential Compromise Investigation

Incident Response·Investigate a GuardDuty HIGH alert for a compromised IAM access key. Trace the attacker's reconnaissance, failed privilege escalation, and sensitive S3 data exfiltration through CloudTrail.

IAM Privilege Escalation Investigation

Incident Response·Investigate unusual IAM policy changes and determine whether a low-privileged identity successfully escalated to AdminRole using CloudTrail and GuardDuty.

RDS Brute Force Attack Investigation

Incident Response·Investigate anomalous RDS authentication failures against a production MySQL instance, determine whether brute force succeeded, and assess post-login database activity.

S3 Data Exfiltration Investigation

Incident Response·Investigate a suspected data exfiltration from a production S3 bucket. Correlate CloudTrail data events, object inventory, and bucket transfer metrics to separate a compromised service credential from legitimate high-volume traffic.

EC2 Web Shell Investigation

Incident Response·Investigate a web-shell compromise on a production EC2 instance. Correlate Apache access logs, Linux process telemetry, file-system events, and DNS logs to reconstruct the full attack chain from initial file upload to post-compromise C2 communication.

AWS Account Takeover Investigation

Incident Response·A security-administration identity signs in from an unfamiliar network without MFA and, within twenty minutes, holds administrative control of a production AWS account. Correlate console sign-in, CloudTrail, IAM writes, and STS sessions to separate what the operator attempted from what actually succeeded — and find the persistence that outlives the session.