This document discusses AWS services for threat detection and response. It begins with an introduction and overview of challenges around threat detection. It then describes AWS services that provide log and activity data for detection. These include GuardDuty and Macie which use machine learning for intelligent detection. Security Hub provides a centralized view of findings. Services like CloudWatch Events and Lambda can be used to automate response actions. The document outlines typical attacker lifecycles and example GuardDuty findings. It provides high-level and detailed playbooks for using AWS services in a threat detection and response workflow.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Find all the threats: AWS threat
detection and remediation
Roger Cheeks
Solutions architect, security specialized
Amazon Web Services
S E C 2 0 2
Brandon Baxter
Solutions architect, security specialized
Amazon Web Services

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Source: Verizon, 2018 Data Breach Investigation Report, 11th ed., 2018
Data-breach patterns

3. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Introduction

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why is threat detection so hard?
Skills shortageSignal to noiseLarge data sets

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Identity and Access
Management (IAM)
AWS Single Sign-On
AWS Directory Service
Amazon Cognito
AWS Organizations
AWS Secrets Manager
AWS Resource Access Manager
AWS Security Hub
Amazon GuardDuty
AWS Config
AWS CloudTrail
Amazon
CloudWatch
Amazon Virtual Private Cloud
(Amazon VPC)
Flow Logs
AWS Systems Manager
AWS Shield
AWS WAF
AWS Firewall Manager
Amazon Inspector
Amazon VPC
AWS Key Management Service
(AWS KMS)
AWS CloudHSM
AWS Certificate Manager
(ACM)
Amazon Macie
Server-side encryption
AWS Config rules
AWS Lambda
Systems Manager
Identity Detect
Infrastructure
protection
Respond
Data
protection
Deep set of security tools

6. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat detection: Log data inputs
DNS logs
Track user activity
and API usage
IP traffic to and from
network interfaces in a
VPC
Monitor apps using log
data, store and access
log files
Log of DNS queries in a
VPC when using the VPC
DNS resolver
CloudTrail VPC Flow Logs CloudWatch

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat detection: Machine learning
Intelligent threat detection and
continuous monitoring to protect your
AWS accounts and workloads
Machine learning–powered security
service to discover, classify, and protect
sensitive data
GuardDuty Macie

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat detection: Security Hub – In preview
• Comprehensive view of your security and compliance state within AWS
• Aggregates security findings generated by other AWS security services and
partners
• Analyze security trends and identify the highest-priority security issues
Amazon
Inspector
GuardDuty Macie
Security Hub
Security
findings
providers
Findings
Insights
and
standards
Other
AWS
Config
Partner
solutions

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat detection: GuardDuty

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat detection: Evocations/triggers
Continuously tracks your resource
configuration changes and if they
violate any of the conditions in your
rules
Delivers a near-real-time stream of
system events that describe changes
in AWS resources
Amazon CloudWatch EventsAWS Config

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Attacker lifecycle: Stages
Reconnaissance
Establish
foothold
Escalate
privileges
Internal
reconnaissance
Maintain
persistence

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Attacker lifecycle: Attacker actions
Remote
Desktop
Protocol (RDP)
brute force
Remote Access
Trojan (RAT)
installed
Exfiltrate data
over DNS
Probe API with
temp creds
Attempt to
compromise
account

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Attacker lifecycle: GuardDuty findings
RDP brute
force
RAT
installed
Exfiltrate
data over
DNS
Probe API
with temp
creds
Attempt to
compromise
account
Malicious or
suspicious IP
Unusual ports
DNS exfiltration
Unusual traffic volume
Connect to blacklisted site
Recon:EC2/PortProbeUnprotectedPort
Anonymizing proxy
Temp credentials
used off-instance
Unusual ISP caller
Bitcoin activity
Unusual instance launch

15. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat response: CloudWatch events
GuardDuty findings
Lambda
function
Partner
solutions
Automated
response
Anything
else
Amazon CloudWatch
Events

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat response: Services
Systems
Manager
Amazon
Inspector
Run code for virtually
any kind of application
or backend service—
zero administration
Gain operational
insights and take action
on AWS resources
Automate security
assessments of Amazon
Elastic Cloud Compute
(Amazon EC2) instances
Lambda

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat response: High-level playbook
Adversary
or intern
Your environment Lambda
function
CloudWatch Events

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat response: Detailed playbook
CloudWatch
Events
CloudTrail
AWS Config
Lambda
function
AWS APIs
Detect
Investigate
Respond
Team
collaboration
(Slack, etc..)
GuardDuty
VPC Flow Logs
Amazon
Inspector
Macie
Security Hub

20. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
https://scaling-threat-detection.awssecworkshops.com/

21. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Roger Cheeks Brandon Baxter