Detections for the Cloud Control Plane

Try it out loud first. Then check yourself:

1. Defense evasion: StopLogging, DeleteTrail, UpdateTrail and PutEventSelectors on CloudTrail, and DeleteDetector in GuardDuty.
2. Persistence and privilege: CreateAccessKey or CreateLoginProfile for another user, AttachUserPolicy with admin, new trust policies on roles.
3. Exposure and theft: bucket policy or ACL made public, snapshots shared outside the org, spikes in GetSecretValue.
4. Harder because API calls are legitimate admin work, logs arrive minutes late, and you need an organization trail covering every region.

If the interviewer pushes back

• How do you tell an attacker using a stolen access key from the CI pipeline using the same key?

Go deeper

• attack.mitre.org/techniques/T1562/008/
• attack.mitre.org/techniques/T1098/001/