Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Detect Unauthorized Access in CloudTrail Logs
Mission
Analyze AWS CloudTrail logs to detect unauthorized IAM access and data exfiltration. Learn cloud forensics. Provided file: cloudtrail.json
Not started
Hints
Hint 1Show
Aggregate sourceIPAddress for errorCode=AccessDenied events in cloudtrail.json; one unfamiliar IP/region dominates
Hint 2Show
Follow that IP's events in time order to see recon -> AttachUserPolicy -> CreateAccessKey -> GetSecretValue
Hint 3Show
The flag is in the final GetSecretValue's responseElements.secretString