Lesson 09 — AWS Logging Evasion & Detection

Learning Objectives

By the end of this lesson, you will be able to:

Understand AWS logging architecture.
Identify common logging evasion techniques.
Assess AWS CloudTrail deployments.
Review CloudWatch Logs and metrics.
Evaluate AWS GuardDuty and Security Hub.
Review AWS Config compliance.
Understand enterprise cloud detection strategies.
Perform logging and monitoring security assessments.

Introduction

Attackers know that remaining undetected is often more valuable than exploiting another vulnerability.

After gaining access to an AWS environment, their next objective is frequently to:

Avoid detection
Disable logging
Hide malicious activity
Remove forensic evidence
Maintain persistence

For this reason, logging and monitoring are critical components of every cloud security assessment.

Professional cloud penetration testers evaluate whether an organization can detect, investigate and respond to suspicious activity.

Enterprise Scenario

CloudNova Technologies has completed a security assessment for FinSecure Bank Ltd.

Before moving to production, management wants to verify that security monitoring can detect:

Unauthorized IAM activity
Suspicious API calls
Privilege escalation
Public resource creation
Kubernetes attacks
Credential misuse
Data exfiltration

Your task is to assess the organization’s logging and detection capabilities.

AWS Logging Architecture

AWS Resources

↓

CloudTrail

↓

CloudWatch Logs

↓

Amazon EventBridge

↓

GuardDuty

↓

Security Hub

↓

SIEM / SOC

↓

Security Analysts

Each service contributes to enterprise detection and response.

AWS Logging Components

Enterprise AWS environments commonly use:

AWS CloudTrail
Amazon CloudWatch
AWS Config
Amazon GuardDuty
AWS Security Hub
Amazon Detective
Amazon Security Lake
VPC Flow Logs
Elastic Load Balancer Logs
S3 Access Logs

All should be reviewed during an assessment.

AWS CloudTrail

CloudTrail records AWS API activity.

Examples include:

User logins
IAM changes
EC2 launches
S3 access
Lambda updates
Security Group changes

CloudTrail is the primary source of evidence during cloud investigations.

CloudTrail Architecture

IAM User

↓

AWS API Call

↓

CloudTrail Event

↓

S3 Log Bucket

↓

CloudWatch Logs

↓

Security Monitoring

CloudTrail Assessment

Review:

Organization Trails
Multi-region logging
Log validation
Encryption
Log retention
CloudWatch integration
Data Events
Management Events

Commands:

aws cloudtrail describe-trails

aws cloudtrail get-trail-status \
--name TRAIL_NAME

CloudWatch Logs

CloudWatch collects:

Application Logs
Lambda Logs
System Logs
Container Logs
Kubernetes Logs

Review:

Log groups
Retention
Encryption
Metric Filters
Log subscriptions

AWS Config

AWS Config continuously evaluates AWS resources against defined rules.

Review:

Configuration Recorder
Delivery Channel
Compliance Rules
Aggregators

Commands:

aws configservice describe-configuration-recorders

aws configservice describe-config-rules

Determine whether configuration drift can be detected.

Amazon GuardDuty

GuardDuty is AWS’s managed threat detection service.

It analyzes:

CloudTrail
VPC Flow Logs
DNS Logs
Kubernetes Audit Logs
EKS Runtime Signals (supported environments)

GuardDuty identifies:

Credential compromise
Cryptocurrency mining
Malware activity
Reconnaissance
IAM anomalies
Data exfiltration attempts

AWS Security Hub

Security Hub aggregates findings from multiple AWS security services.

Review:

Enabled standards
Findings
Integrations
Severity
Compliance status

Common standards include:

AWS Foundational Security Best Practices
CIS AWS Foundations Benchmark
PCI DSS

Amazon Detective

Amazon Detective helps analysts investigate incidents by correlating:

API activity
IAM behavior
EC2 activity
Kubernetes activity
Network traffic

Review whether Detective is enabled and integrated with GuardDuty.

Amazon Security Lake

Security Lake centralizes logs from:

CloudTrail
VPC Flow Logs
Route 53
EKS Audit Logs
Security Hub
GuardDuty

Benefits include:

Centralized investigations
Long-term log retention
SIEM integration
Cross-account visibility

VPC Flow Logs

Review:

Enabled VPCs
Retention
Storage location
CloudWatch integration

Flow Logs help detect:

Port scanning
Unexpected traffic
Lateral movement
Network anomalies

Kubernetes Audit Logs

Amazon EKS supports Kubernetes audit logging.

Review:

aws eks describe-cluster \
--name CLUSTER_NAME

Verify enabled log types:

API
Audit
Authenticator
Controller Manager
Scheduler

Audit logs are essential for Kubernetes incident investigations.

Common Logging Evasion Techniques

Attackers may attempt to:

Disable CloudTrail.
Delete CloudTrail trails.
Stop AWS Config recording.
Delete CloudWatch log groups.
Remove EventBridge rules.
Modify IAM logging permissions.
Delete S3 log buckets.
Disable GuardDuty.
Disable Security Hub.
Remove Kubernetes audit logging.

These actions often generate additional security events when monitoring is configured correctly.

Enterprise Attack Path

Compromised IAM User

↓

Administrator Role

↓

Disable CloudTrail

↓

Delete GuardDuty Findings

↓

Launch EC2

↓

Access Amazon S3

↓

Data Exfiltration

Without proper monitoring, these actions may go unnoticed.

Logging Assessment Commands

Describe CloudTrail

aws cloudtrail describe-trails

CloudTrail status

aws cloudtrail get-trail-status \
--name TRAIL_NAME

Describe CloudWatch log groups

aws logs describe-log-groups

Describe Config Rules

aws configservice describe-config-rules

List GuardDuty detectors

aws guardduty list-detectors

List Security Hub findings

aws securityhub get-findings

Describe VPC Flow Logs

aws ec2 describe-flow-logs

Describe EventBridge rules

aws events list-rules

Enterprise Assessment Workflow

Professional consultants typically follow this methodology.

Review CloudTrail

↓

Review CloudWatch

↓

Review AWS Config

↓

Review GuardDuty

↓

Review Security Hub

↓

Review Detective

↓

Review Security Lake

↓

Review Kubernetes Audit Logs

↓

Identify Detection Gaps

↓

Document Findings

Common Enterprise Findings

Examples include:

CloudTrail disabled in one or more regions
No organization trail
CloudTrail Data Events disabled
Missing CloudWatch metric filters
Short log retention periods
AWS Config disabled
GuardDuty not enabled
Security Hub disabled
Missing VPC Flow Logs
Kubernetes audit logs disabled
No centralized log aggregation
Weak alerting for IAM changes

Security Best Practices

Enable Organization-wide CloudTrail.
Enable multi-region logging.
Encrypt logs using AWS KMS.
Store logs in a dedicated log archive account.
Enable GuardDuty across all accounts.
Enable AWS Config in every region.
Enable Security Hub and Detective.
Collect Kubernetes audit logs.
Enable VPC Flow Logs.
Integrate logs with a SIEM or Amazon Security Lake.
Protect log storage using least privilege and immutable retention where appropriate.

Common Mistakes

Avoid:

Logging only management events.
Disabling CloudTrail Data Events.
Using short log retention periods.
Storing logs without encryption.
Ignoring GuardDuty findings.
Not monitoring IAM changes.
Failing to aggregate logs across accounts.
Leaving Kubernetes audit logging disabled.

Knowledge Check

1. Why is AWS CloudTrail critical during incident investigations?

Answer: CloudTrail records AWS API activity, providing an audit trail of actions performed by users, roles and AWS services. It is a primary source of evidence during cloud forensic investigations.

2. What is the purpose of Amazon GuardDuty?

Answer: GuardDuty continuously analyzes AWS telemetry to detect suspicious activity such as credential compromise, reconnaissance, privilege escalation and data exfiltration.

3. Why should AWS Config be enabled?

Answer: AWS Config tracks resource configurations and detects configuration drift, helping organizations identify unauthorized or non-compliant changes.

4. Why are Kubernetes audit logs important?

Answer: Kubernetes audit logs record API activity within the cluster, enabling security teams to investigate RBAC changes, workload creation, administrative actions and suspicious behavior.

5. Why do attackers attempt to disable logging?

Answer: Attackers seek to reduce visibility, delay detection and remove forensic evidence, increasing the likelihood that malicious activity will remain undiscovered.

Key Takeaways

Logging and monitoring are fundamental to cloud detection and incident response.
CloudTrail, CloudWatch, AWS Config, GuardDuty and Security Hub provide complementary visibility into AWS environments.
Enterprise assessments should evaluate both logging coverage and the ability to detect suspicious activity.
Centralized logging and immutable evidence significantly improve forensic readiness.
Strong monitoring capabilities reduce attacker dwell time and improve an organization’s ability to respond to cloud security incidents.

What’s Next?

In the next lesson, you will explore Lesson 10 — Enterprise AWS Attack Path Analysis, where you will learn how to chain AWS misconfigurations into realistic attack paths, evaluate business impact and prioritize remediation using enterprise cloud penetration testing methodologies.

➡️ Next Lesson: Lesson 10 — Enterprise AWS Attack Path Analysis