AWS Overview

• Introduction to AWS core concepts and architecture.

Hands-on Configuration

• Practical configuration of AWS services including IAM, EC2, Lambda, and S3. Provides fundamental knowledge before covering how these services are exploited by threat actors.

CloudTrail Fundamentals

• Learn the core concepts and functionalities of AWS CloudTrail.

Configuring CloudTrail

• Master the process of setting up CloudTrail trails to capture relevant events and activities.

Log Interpretation

• Develop the ability to decipher CloudTrail logs to identify user activities, API calls, and resource changes.

Threat Detection

• Learn to recognize indicators of compromise (IoCs), indicators of attack (IoA) and anomalies within CloudTrail logs.

Advanced Analysis Techniques

• Explore methods for extracting actionable intelligence from CloudTrail data.

Common AWS Attack Vectors

• Explore real-world attack scenarios, including unauthorised access and data exfiltration.

Threat Actor Tactics

• Analyse the techniques employed by malicious actors to target AWS environments, aligning them with the industry-standard MITRE ATT&CK Framework.

Advanced Threat Hunting with CloudTrail

• Analyse attacker methodologies and tactics as captured in CloudTrail logs to understand the techniques used by adversaries, enabling you to proactively identify and counteract potential threats.

Practical Tips for Effective CloudTrail-Based Threat Hunting

• Learn proven best practices and actionable strategies to perform robust threat hunting with CloudTrail, ensuring you can efficiently monitor, detect, and respond to evolving cyber risks.

Hands-On Labs

• Practical exercises configuring AWS services and analysing real attack scenarios

Live Demonstrations

• Instructor-led attack simulations and CloudTrail investigation walkthroughs

Real-World Case Studies

• Analysis of actual cloud security incidents and threat actor tactics

Interactive Discussions

• Q&A sessions and group analysis of threat detection scenarios