AWS GuardDuty Threat Detection & Incident Response

Project Overview

SecureShop Pvt Ltd required a cloud-native threat detection solution to identify and investigate suspicious activity within its AWS environment.

This project demonstrates the implementation of AWS GuardDuty for continuous threat monitoring and incident investigation.

Objectives

• Enable AWS GuardDuty
• Generate and analyze sample security findings
• Investigate critical security alerts
• Perform incident response analysis
• Document remediation recommendations

Services Used

• AWS GuardDuty
• AWS IAM
• AWS CloudTrail

Security Findings Investigated

Critical Finding

AttackSequence:IAM/CompromisedCredentials

GuardDuty detected a potential compromise of IAM user credentials.

Indicators included:

• Connection from a Tor Exit Node
• CloudTrail deletion attempt
• IAM role creation
• IAM policy attachment
• IAM user enumeration activity

Risk Assessment

Severity: Critical

Potential Impact:

• Privilege Escalation
• Persistence
• Defense Evasion
• Unauthorized Access

Investigation Process

1. Reviewed GuardDuty findings
2. Analyzed attack sequence signals
3. Identified suspicious API activity
4. Assessed potential impact
5. Recommended remediation actions

Remediation Recommendations

• Disable compromised credentials
• Rotate access keys
• Enable MFA
• Review IAM permissions
• Audit CloudTrail activity
• Monitor future GuardDuty findings
• | Finding | Severity | Status | |---|---|---| | AttackSequence:IAM/CompromisedCredentials | CRITICAL | Investigated | | UnauthorizedAccess:IAMUser/TorIPCaller | HIGH | Documented |

Screenshots

Project screenshots are included in this repository.

Skills Demonstrated

• Cloud Security Monitoring
• Threat Detection
• Incident Response
• AWS Security Services
• Security Analysis
• IAM Security

Author

Siri Chandana Aspiring Cloud Security Engineer