# AWS Security Logging | TryHackMe Walkthrough

Dive into various AWS log sources and learn how they can help your SOC team.

Link to the room [https://tryhackme.com/room/awssecuritylogging](https://tryhackme.com/room/awssecuritylogging)

## **Task 3:Covering AWS Control Plane**

> ***From which IP did jeff.harrison user log in to AWS?***

![](https://miro.medium.com/v2/resize:fit:1250/1*FOMY_5RNjESu1JKw2UvoGA.png align="center")

***Ans: 149.40.62.48***

> ***To which AWS account ID did jeff.harrison user log in?***

***Ans: 398985017225***

> ***What S3 bucket did jeff.harrison create after the login?***

index=aws user=”jeff.harrison” eventName=Createbucket

![](https://miro.medium.com/v2/resize:fit:875/1*qRwBnMFwr09CuX2--lR1Iw.png align="center")

***Ans: prod-website-thm***

## **Task 4:CloudTrail and GuardDuty**

> ***Find the “AnomalousBehavior” GuardDuty alert in the logs.  
> From which VPN did the suspicious activity originate?***

![](https://miro.medium.com/v2/resize:fit:875/1*jtbsrM2VNVJXY7JeSGpT1g.png align="center")

***Ans: ProtonVPN***

> ***Analyze two other alerts from the i-04fa0268276e1f763 EC2 instance.  
> What is the path to the detected malware, and which domain did it query?***

![](https://miro.medium.com/v2/resize:fit:1250/1*rPH7Hf_2oA_WzOTQPYlcyg.png align="center")

![](https://miro.medium.com/v2/resize:fit:1250/1*1z_hPbBIf5q0S79_Zi02FA.png align="center")

***Ans: /home/ubuntu/xmrig-6.24.0/xmrig,*** [***donate.v2.xmrig.com***](http://donate.v2.xmrig.com)

> ***Continue to the CloudTrail logs to get more instance context.  
> Who created the infected EC2 instance? Provide the full ARN field.***

index=aws sourcetype=aws:cloudtrail i-04fa0268276e1f763 action=created

![](https://miro.medium.com/v2/resize:fit:875/1*Z3VfGu7VJKJxVLNl9Cm5Zw.png align="center")

***Ans: arn:aws:iam::398985017225:root***

> ***Which two risky ports did that user expose for the EC2 instance?***

index=aws sourcetype=aws:cloudtrail eventName=ModifySecurityGroupRules

![](https://miro.medium.com/v2/resize:fit:875/1*bXV5TtgCMOkvToQ3XbnCsg.png align="center")

***Ans: 22, 3389***

## **Task 5:Covering Managed Services**

> ***Start with the CloudFront access logs.  
> Which IP address logged in to the admin portal?***

![](https://miro.medium.com/v2/resize:fit:1250/1*2bzNNuAbgjJoJoMK6mEn1g.png align="center")

***Ans: 168.84.119.124***

> ***Find an answer in the same CloudFront logs.  
> How many IPs searched for the “tryhackme” keyword?***

![](https://miro.medium.com/v2/resize:fit:1250/1*uEGoqlL9syucF_3xTMqHdw.png align="center")

***Ans: 14***

> ***Now, move on to the S3 Data events.  
> Which interesting S3 file has been accessed?***

![](https://miro.medium.com/v2/resize:fit:875/1*o4eTtX0O-_khRtoNayxqfQ.png align="center")

***Ans: backup.tar.gz***

**THANK YOU FOR READING!!! ❤️💫**