- [Instructor] Welcome, everyone.
In this video, I'm gonna walk through a demonstration
of investigating a security scenario with Amazon Detective.
If you're unaware, Amazon Detective is a service
that makes it easy to analyze, investigate
and quickly identify the root cause
of security findings, or suspicious activities.
Detective automatically collects log data
from your AWS resources.
It then uses machine learning,
statistical analysis, and graph theory
to generate visualizations that help you to conduct faster
and more efficient security investigations.
In this walkthrough,
we're gonna use the Detective console
to investigate a scenario
where a team has launched an instance
with SSH open to the world,
which resulted in multiple Guard Duty findings.
Our scenario starts with an actor
successfully exploitating this instance
because there is a SSH user set with an insecure password.
Once the actor has access to the instance,
they start enumerating the environment
and also attempting defense evasion techniques,
for example, disabling Guard Duty.
After enumeration, the actor exfiltrates the data
on the instance and anything that was collected from S3.
Once the data has been exfiltrated,
they began bitcoin mining
in the environment to attempt to make money using EC2.
As you can see at the bottom,
there are three Guard Duty findings associated
with this scenario that we will investigate using Detective.
We are gonna start out our investigation
from the Guard Duty console.
In this example, a high severity
Guard Duty finding, TrojanEC2 DNS data exfiltration
was brought to our attention.
This might happen several ways.
For example, through chat integrations,
ticket systems, et cetera.
We're gonna select the Investigate with Detective link.
Each link shown here is a different AWS entity related
to this Guard Duty finding
that we can investigate using Detective.
For this investigation,
we'll start by clicking on the link for the EC2 instance.
Now that we're in the Detective console,
we can see the instance details associated
with the instance that is linked to the DNS exfiltration
Guard Duty finding.
And on the right side of the screen,
we can also see all the Guard Duty finding details,
just like we saw in the Guard Duty console.
On this page,
we can answer questions like,
when was this instance created?
What IM entity created this instance?
What role is associated with this instance?
We can also see that this finding was first observed
on the 7th,
and if we scroll,
we can look at the inbound traffic flow chart
that is created by gathering VPC flow log data.
We can also see that there is a corresponding spike
in traffic on the same day of the Guard Duty finding.
We can then filter by distinct ports.
So in this scenario, it was filtered by remote port 53,
since we know this is a DNS finding.
If we select the check box
next to one of these IP addresses,
we can see the traffic
from this IP address is associated
with the spike on the 7th.
If we wanted to, from here,
we could also select this IP address
and find out all the traffic associated
with this IP address in our AWS environment.
All of this information that we are looking at here
is tied to what we call scope time.
The scope time for a Guard Duty finding is
from the first observation of that finding
to the last observation of that finding.
If we wanted, we can change the scope time
to look at activity side of that window.
Detective stores data for a year at a time
that we can look at.
For this example, I'll change it to 30 days.
Now that we have changed the scope time,
we can see, if we scroll down,
that there was a second finding associated
with this instance.
This brute force finding starts to paint the picture
of how the actor might have gotten access to the instance.
From here, I wanna select a role to dive
into what else the attacker might have done
after getting access to the instance
and the role that is attached to it.
Once on the role entity page,
I will go down to the Overall API Calls section
and then look at the API call trend data
for the day when the DNS Guard Duty finding occurred.
I see that there was a lot
of activity and some failed calls
for a particular IP, so I will expand out that row.
If I expand S3, Guard Duty, EC2, and cloudtrail rows,
it looks like this role was trying to enumerate S3,
delete cloudtrail,
presumably to cover their tracks.
It also looks like they were looking to see
if Guard Duty was enabled
and the role has created some EC2 instances,
using the EC2 run instance API.
At this point,
we might have enough information to start response
and recovery efforts, potentially,
through revoking sessions and quarantining EC2 instances.
To make sure we're not missing anything though,
I will select the account ID,
see all activity associated with the account as a whole.
Now on the account entity page, we can see there are a lot
of findings associated with this account.
I'm gonna jump right into one
of these bitcoin mining findings,
because we saw that the role in question had
60 successful EC2 run instance APIs calls,
which leads me to believe
that the role was creating bitcoin mining instances.
After clicking on the bitcoin finding,
we're brought to a page that shows all
of the entities associated
with the Guard Duty finding.
Once again, we can also see the Guard Duty finding details
related to this bitcoin finding
on the right side of the screen.
We can now dive into any of these entities
to continue our investigation.
For this example, though, we just want to confirm
that the role that was associated
with our EC2 instance that had a brute force finding
and a DNS exfiltration finding associated
with it is the same role that is now being used
to create bitcoin mining instances.
If we look at the EC2 instance entity
in the bottom right hand corner,
we can see that bitcoin mining instance was indeed created
by the same role.
In this video, you have seen
how to use Amazon Detective to investigate
an attack scenario in your AWS environment.
As you can see,
Amazon Detective gives you the ability to collect data
for insight into resource interaction
and data visualizations, making investigating activity
in your AWS environment much more efficient.
For more information,
you can go to aws.amazon.com/detective.