AWS SOC Analyst Short Course | SOC Real World Scenarios

I see a lot of people trying to break into Blue Team/SOC roles by obsessing over network traffic and malware signatures. While that's still important, if you ignore Cloud SOC, you’re fighting a war that ended 5 years ago.

In a modern AWS environment, the "hack" rarely involves a virus payload or a firewall breach. It involves a valid user running administrative commands.

I recently did a deep dive into two AWS attack scenarios using CloudTrail and Splunk. Here is the breakdown of what a real cloud compromise looks like (and why you need to get fluent in JSON).

Scenario 1: The S3 Ransomware Trap We tracked a compromised user ("S3-User"). They didn't run an exploit. They ran standard CLI commands:

Recon: ListBuckets and GetBucketEncryption to find the unencrypted, high-value targets.
The Attack: A sudden spike in GetObject (exfiltration) followed by PutObject uploading a ransom-note.txt.

If you’re looking for a malicious IP, you’ll miss this. You need to be monitoring for behavioral anomalies in API calls. A user who usually writes data suddenly downloading 50GBs is your alert.

Scenario 2: The "Helpdesk" Backdoor This one was scarier. An attacker brute-forced a helpdesk account.

Persistence: They ran CreateUser to make a new account named marketing-mark (blends in with HR).
Escalation: Immediately ran AddUserToGroup to make "Mark" an Admin.
Exposure: Ran DeleteBucketPublicAccessBlock to open storage to the internet.

In the cloud, Identity is the Perimeter. IP addresses are ephemeral. The only constant is the IAM User/Role. If you can't parse CloudTrail JSON to correlate a CreateUser event with a privilege escalation, you are flying blind.

If you want to see the step-by-step investigation (including the Splunk queries used):

📺 Watch the full walkthrough here: