Ticket summary
On 3 September 2026 the NovaCrest SOC opened IR-2026-0903-055 after GuardDuty triggered Trojan:EC2/DriveBySourceTraffic!DNS against the analytics platform web instance. The instance is querying a suspicious domain not present in normal traffic. No customer data exfiltration has been confirmed. You are the investigating analyst.
NovaCrest Analytics runs a public web application on a single EC2 instance (Apache on ports 80/443, internal API on 3000). GuardDuty flagged the instance for repeated DNS queries to a domain associated with drive-by source traffic.
The ticket includes seven evidence exports for the morning window: a GuardDuty finding, DNS query logs, VPC Flow Logs, the instance record, Apache access logs, Linux process/system events, and a CloudTrail slice. Your job is to correlate these sources, identify the trigger, and determine whether the instance has been compromised.
Suspicious DNS activity is not automatic evidence of compromise. Work through each source and build a timeline before drawing conclusions. CloudTrail intentionally contains only management-plane events — you will not find host-level compromise evidence there.