AWS Athena lets adversaries run massive SELECT queries against S3-stored data lakes — and the resulting data exfiltration leaves a trail that most cloud SOCs do not monitor. This article catalogues the three Athena exfiltration patterns and ships the detection queries that surface them.
Sophisticated adversaries are increasingly abusing native AWS messaging — EventBridge buses, SNS topics, and SQS queues — as command-and-control channels. The traffic blends with legitimate internal application messaging and produces no obvious external-network indicators. This article catalogues the patterns and ships the detection logic.
The AWS CI/CD attack surface — CodeBuild project configurations, CodePipeline triggers, buildspec.yml files, and build-runner IAM roles — is one of the most under-monitored layers in modern cloud environments. This article ships a focused hunt playbook for the four most exploited CI/CD compromise patterns observed in production incidents.
GuardDuty is the default-on threat-detection service in AWS — and sophisticated adversaries actively engineer their operations to avoid triggering its findings. This article catalogues nine specific evasion techniques observed in cloud incident response, and ships the hunt patterns that surface the silence itself.
Adversaries are increasingly weaponising AWS KMS for ransomware — encrypting victim data with attacker-controlled keys, modifying key policies to lock out the legitimate owner, and using grant tokens for stealth access. This hunt playbook covers the techniques, the detection logic, and the response actions for KMS-mediated ransomware.
