Cloud-Native Incident Response Simulation Lab

A complete AWS security breach simulation demonstrating professional SOC incident response methodology.

---

🎯 Project Overview

End-to-end cloud security incident simulation featuring:

• 3-phase attack chain: Initial access → Privilege escalation → Data exfiltration
• Automated forensics: Custom Python tools analyzing 12,000+ CloudTrail events
• Professional documentation: 25-page incident response report with executive summary
• MITRE ATT&CK mapping: 5 techniques across 4 tactics
• NIST SP 800-61 alignment: Structured incident response methodology

---

📊 Project Statistics

Metric	Value
CloudTrail Events Analyzed	12,444
Suspicious Events Identified	15 (0.12% signal-to-noise)
Attack Scripts Developed	3 (766 lines of Python)
Data Exfiltrated	4 files (2.52 KB) - PII, healthcare, credentials
IOCs Extracted	2 users, 2 IPs, 2 access keys
Documentation	588 lines (IR report + technical docs)

---

🔥 Simulated Attack Scenario

Initial Compromise

AWS service account credentials (dev-api-service) leaked via insecure storage, granting attacker access with overly permissive IAM policy:

• s3:* on all buckets
• iam:CreateUser + iam:AttachUserPolicy

Attack Timeline

Phase 1: Reconnaissance (21:01:33 - 21:01:50 UTC)

• 7 enumeration API calls in 17 seconds
• Discovered S3 buckets, IAM users, network topology

Phase 2: Privilege Escalation (21:06:03 - 21:07:32 UTC)

• Created backdoor user backup-admin
• Attached AdministratorAccess policy
• Generated persistent access keys

Phase 3: Data Exfiltration (21:11:59 - 21:12:03 UTC)

• Downloaded 4 sensitive files:
  • customers.csv - PII with SSN and credit cards
  • patient-records.csv - HIPAA protected healthcare data
  • api-keys.txt - Third-party service credentials
  • transactions.json - Financial transaction records

---

🛠️ Technical Architecture

┌─────────────────────────────────────────────────────────────┐
│                    AWS ENVIRONMENT                          │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  CloudTrail (Multi-Region)                                 │
│  └─> Logs all API calls to S3                             │
│  └─> Log validation enabled (tamper-proof)                │
│                                                             │
│  Victim Environment                                         │
│  ├─> IAM: dev-api-service (vulnerable policy)             │
│  ├─> S3: customer-data-027929660855 (sensitive data)      │
│  └─> IAM: backup-admin (attacker-created backdoor)        │
│                                                             │
│  GuardDuty (Planned)                                       │
│  └─> Automated threat detection (pending activation)       │
│                                                             │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│              FORENSIC INVESTIGATION                         │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  CloudTrail Logs (1,989 files, 25 MB)                     │
│  └─> 12,444 total events                                   │
│                                                             │
│  forensic_analyzer.py                                       │
│  ├─> Filters to 15 suspicious events                      │
│  ├─> Builds attack timeline                                │
│  ├─> Extracts IOCs                                         │
│  └─> Generates investigation report (JSON)                 │
│                                                             │
│  Incident Response Report (Markdown)                        │
│  ├─> Executive summary                                     │
│  ├─> Technical timeline with evidence                      │
│  ├─> Root cause analysis                                   │
│  └─> Remediation recommendations                           │
│                                                             │
└─────────────────────────────────────────────────────────────┘

---

📁 Project Structure

cloud-ir-simulation/
│
├── attack-simulation/          # Attack phase artifacts
│   ├── scripts/
│   │   ├── reconnaissance.py           # Phase 1: Discovery
│   │   ├── privilege_escalation.py     # Phase 2: Backdoor creation
│   │   └── data_exfiltration.py        # Phase 3: Data theft
│   ├── mock-data/                      # Simulated sensitive data
│   ├── reconnaissance-report.json      # Discovery results
│   ├── privilege-escalation-report.json
│   ├── exfiltration-report.json
│   ├── VULNERABILITIES.md              # Security gap analysis
│   └── vulnerable-policy.json          # Overly permissive IAM policy
│
├── scripts/                    # Forensic investigation tools
│   ├── forensic_analyzer.py            # Main analysis tool
│   └── guardduty_fetcher.py            # GuardDuty integration (planned)
│
├── evidence/                   # Investigation artifacts
│   ├── cloudtrail-logs/                # 12,444 API events (25 MB)
│   └── investigation-report.json       # Machine-readable findings
│
├── docs/                       # Documentation
│   ├── incident-response-report.md     # 25-page IR report
│   ├── progress-log.md                 # Session notes
│   ├── guardduty-integration.md        # Future enhancement plan
│   └── cloudtrail-bucket-policy.json   # Infrastructure config
│
└── detection/                  # SIEM rules (future)

---

🔍 MITRE ATT&CK Techniques

Tactic	Technique	Implementation
Initial Access	T1078.004 - Valid Cloud Accounts	Compromised AWS credentials
Discovery	T1580 - Cloud Infrastructure Discovery	ListBuckets, DescribeInstances
Privilege Escalation	T1098.001 - Additional Cloud Credentials	CreateUser, AttachUserPolicy
Collection	T1530 - Data from Cloud Storage	GetObject on sensitive S3 files
Exfiltration	T1537 - Transfer Data to Cloud Account	Downloaded to attacker system

---

🚀 Usage

Prerequisites

• AWS account with appropriate permissions
• Python 3.11+
• AWS CLI configured
• boto3 library

Quick Start

1. Clone and setup:

git clone <repository-url>
cd cloud-ir-simulation
pip install boto3 --break-system-packages

2. Configure AWS credentials:

aws configure
# Enter your access key, secret key, and region

3. Run forensic analysis:

# Analyze CloudTrail logs to find the attack
python3 scripts/forensic_analyzer.py

4. View results:

# Investigation findings (JSON)
cat evidence/investigation-report.json | jq '.'

# Full incident response report (Markdown)
cat docs/incident-response-report.md | less

Re-running Attack Simulation

# Phase 1: Reconnaissance
python3 attack-simulation/scripts/reconnaissance.py

# Phase 2: Privilege Escalation
python3 attack-simulation/scripts/privilege_escalation.py

# Phase 3: Data Exfiltration
python3 attack-simulation/scripts/data_exfiltration.py

---

📈 Key Findings

Root Cause

Overly permissive IAM policy granting service account ability to:

• Access ALL S3 buckets (s3:*)
• Create IAM users (iam:CreateUser)
• Attach ANY policy (iam:AttachUserPolicy)

Security Gaps Identified

1. ❌ S3 data events not logged in CloudTrail
2. ❌ S3 bucket encryption not enabled
3. ❌ No automated alerting (GuardDuty pending activation)
4. ❌ No S3 access logging
5. ❌ Wildcard IAM permissions

Compliance Impact

• GDPR: Article 32 encryption requirement violated
• HIPAA: Security Rule encryption standard violated
• PCI-DSS: Requirement 3.4 cardholder data protection violated

---

🛡️ Remediation

Immediate Actions

1. Revoke compromised credentials
2. Delete backdoor user (backup-admin)
3. Implement least-privilege IAM policy
4. Enable S3 bucket encryption
5. Enable S3 access logging

Long-term Improvements

1. Enable GuardDuty for automated threat detection
2. Configure CloudWatch alarms for IAM actions
3. Enable S3 data event logging
4. Deploy AWS Config for compliance
5. Implement IAM permission boundaries

---

📚 Skills Demonstrated

Cloud Security:

• AWS CloudTrail forensics
• IAM policy analysis
• S3 security controls
• Threat detection strategies

Incident Response:

• NIST SP 800-61 methodology
• IOC extraction and correlation
• Timeline reconstruction
• Root cause analysis
• Executive reporting

Technical:

• Python automation (1,242 lines)
• Log analysis at scale (12K+ events)
• MITRE ATT&CK framework
• Git version control (10 commits)

---

🔮 Future Enhancements

• GuardDuty integration (automated findings correlation)
• ELK Stack deployment (centralized log analysis)
• Custom SIEM detection rules
• Automated remediation with Lambda
• AWS Security Hub integration

See docs/guardduty-integration.md for detailed integration plan.

---

⚠️ Disclaimer

This is a controlled security research project for educational purposes.

• All attack activity conducted in isolated AWS account
• Mock sensitive data used (no real PII)
• Access keys redacted in public documentation
• Complies with AWS Acceptable Use Policy

---

📝 Documentation

Document	Description
docs/incident-response-report.md	Complete 25-page IR report
docs/progress-log.md	Session-by-session development notes
attack-simulation/VULNERABILITIES.md	Security gap analysis
docs/guardduty-integration.md	Future enhancement plan

---

🎓 Learning Resources

• NIST SP 800-61 Rev 2 - Incident Response Guide
• MITRE ATT&CK Cloud Matrix - Attack Techniques
• AWS CloudTrail User Guide - Log Analysis
• AWS Security Best Practices - Architecture

---

👤 Author

Imam Uddin Mohammed

• Cybersecurity Graduate Student @ University of Central Oklahoma
• Focus: Cloud Security, Incident Response, Threat Hunting

---

📄 License

This project is for educational purposes. See organization policies regarding security research.

---

Built with Python 🐍 | Powered by AWS ☁️ | Aligned with NIST 📋