Lion Cipher Lab

Investigate a cloud intrusion with CloudTrail and GuardDuty (capstone)

• Cloud Security
• Advanced
• ~90 min
• Free · no account required

Why it matters

In the cloud there is no disk to image and no server room to walk into — the crime scene is an API log. Almost every real cloud compromise starts with a leaked credential and shows up first as strange API calls: reconnaissance, privilege probing, attempts to create persistence. A defender who can open CloudTrail, trace which identity did what, and tell GuardDuty's 'something's off' apart from the full blast radius is doing the single most valuable thing in cloud security. This capstone makes you practise that reconstruction end to end, safely, in an account you own.

What you'll learn

• Cloud incident response (IR)
• Reading AWS CloudTrail logs like an investigator
• Interpreting GuardDuty findings
• Attack timeline reconstruction
• Tracing a caller identity (userIdentity, accessKeyId)
• Scoping blast radius
• Writing containment / eradication / recovery recommendations

Steps in this lab

1. The mindset: your account is the crime scene, and the logs are the evidence
2. Prepare, and keep the account safe (cost + blast-radius guardrails)
3. Stage the intrusion: create a throwaway identity and a leaked key
4. Play the intruder: run an attacker-shaped burst of API calls
5. Detect: read GuardDuty findings — the smoke, not the fire
6. Analyse, part 1: reconstruct the timeline in CloudTrail Event history
7. Analyse, part 2: trace the identity by reading the raw event JSON
8. Scope the blast radius, then write the findings
9. Recover the account: full teardown so nothing lingers
10. What you just proved you can do

Open the full interactive lab →