Obfuscating CloudTrail logs
CloudTrail is a service within Amazon that monitors any actions that are done by users. Assuming attackers now have high-privileged access to the environment, they will be able to modify the settings by performing the following actions:
- Identify the CloudTrail details by running
sudo aws cloudtrail describe-details –profile <profile name>. - Attackers can choose to perform the removal of trails by running
sudo aws cloudtrail delete-trail --name cloudgoat_trail --profile <Profile name>. - Alternatively, they can stop the logging by running
sudo aws cloudtrail stop-logging --name cloudgoat_trail --profile <Profile name>. However, it will trigger an alert in GuardDuty (a threat detection service within AWS) about the logs not being captured.
We have explored the important aspects of cloud penetration testing with some practical examples. Pentesters should always consider any cloud infrastructure as part...
