With Amazon GuardDuty, a fully managed service by AWS, this exercise will cover how to detect system threats and remediate them. We will conduct analysis, assessment and how to alarm and remediate security issues based on the findings (Findings) of GuardDuty.
To prepare for this exercise, using the built-in CloudFormation Template, we will reproduce the attacks and automated fixes by combining EventBridge Event Rules and Lambda Functions.
The exercise will be set at us-west-2 (Oregon).
For more details, see Environment Setup.
The exercise will cover the following scenarios:
| Order | Name | Specification | Solution |
|---|---|---|---|
| 1 | Compromised EC2 instance | Detect and recover hacked EC2 instances | Combination of Amazon GuardDuty, Amazon EventBridge Event Rules and AWS Lambda |
| 2 | Compromised IAM credentials | Identify an individual who is actively calling an API to the system on AWS | Fix this hazard immediately (manually) |
| 3 | IAM role exfiltration | Through a leaked credential, an individual is attempting to hack and call the API from an external server | Fix it with AWS Lambda |
Details are in Environment Cleanup.