Lion Cipher Lab

Detect and prevent tampering with your AWS security logging (CloudTrail, GuardDuty, Config, flow logs)

• Cloud Security
• Intermediate
• ~90 min
• Free · no account required

Why it matters

An intruder who reaches an AWS account with enough permissions often does the same thing first: turn off the cameras. Stop the trail, delete the GuardDuty detector, stop AWS Config, delete the flow logs, or set the log bucket to expire everything after a day. Every investigation after that point is blind. MITRE ATT&CK tracks this as its own technique for exactly that reason. The defender's job is to notice within minutes, and better still, to make the off-switch refuse to work. This lab gives you both halves on your own machine: rules you measure honestly with precision and recall, a silence…

What you'll learn

• Knowing which AWS API calls switch off or degrade security telemetry (CloudTrail, GuardDuty, Config, VPC flow logs, log buckets, log groups)
• Mapping logging tampering to MITRE ATT&CK T1685.002 (formerly T1562.008)
• Measuring a detection rule with precision and recall against a planted ground truth
• Tuning: resource scoping, coverage-aware severity, change-window suppression, and escalation on denied attempts and sequences
• Catching the quiet tamper: a PutEventSelectors call that drops data events while the trail stays on
• Building a heartbeat (silence) alert and choosing its threshold from measured false alarms
• Writing an SCP that denies telemetry off-switches except to a break-glass role, and replaying it offline
• Knowing what detection and SCPs cannot see: the management account, exempt roles, never-created trails, delivery latency

Steps in this lab

1. The attack you are defending against: turning off the cameras
2. The tamper map: which API calls blind which sensor
3. Set up a folder and check Python
4. Generate one week of CloudTrail records with planted tampering
5. Score the naive rule: catch everything, drown the analyst
6. How the tuned rule thinks: scope, severity, suppression, escalation
7. The quiet tamper: the trail is still ON
8. Honest negative: suppression is a gift to whoever holds the suppressed role
9. Latency: how many minutes the attacker gets
10. The heartbeat: catch the silence no event rule can see
11. Prevention: an SCP that makes the off-switch refuse
12. Replay the SCP against the week: 8 of 9 blocked, and what it breaks
13. A sink the attacker cannot touch: organization trail, log-archive account, Object Lock
14. What none of this can see
15. When to use which control, and how a pro runs it

Open the full interactive lab →