Zbulimi i Abuzimit me IAM

Cloud providers log every API call through the control plane: CloudTrail for AWS, Activity Log for Azure, Cloud Audit Logs for GCP.

These logs are gold for detection. A sudden ListBuckets from an unfamiliar IP, a CreateAccessKey on a service account, an AssumeRole across accounts that has never been used before — all are signals worth investigating. Rules in tools like GuardDuty, Azure Defender for Cloud and Chronicle Detect compile such patterns into managed detections; open-source frameworks like Panther, Matano and Elastic provide similar coverage on self-hosted stacks. Attack techniques evolve and detections must keep pace. The MITRE ATT&CK for Cloud matrix documents common techniques: Valid Accounts, Create Account, Modify Cloud Compute Infrastructure, Cloud Service Dashboard enumeration. Stratus Red Team and Leonidas are open-source tools that emulate these techniques in a sandbox tenant so defenders can verify their detections actually fire. A mature detection program writes each rule with: a clear description of the adversary behavior, the data source and query, expected noise and tuning notes, and a linked playbook that tells the responder what to do when it fires. Without the playbook the rule becomes noise; with it, each alert is an actionable hunt.

Sinjale:

• CloudTrail events: ConsoleLogin nga IP e pazakonshme, CreateAccessKey, AttachUserPolicy me AdministratorAccess.
• GuardDuty finding-et (UnauthorizedAccess, Stealth).
• Anomalitë në SCP (Service Control Policies) bypass.

Query CloudWatch Insights për ConsoleLogin nga IP të reja:

fields @timestamp, userIdentity.userName, sourceIPAddress
| filter eventName = "ConsoleLogin" and awsRegion = "us-east-1"
| stats count() by sourceIPAddress
| sort count desc

1. Konfiguro një alertë për CreateAccessKey jashtë orëve të punës.
2. Simulo një incident — krijo MFA bypass me CLI dhe shih çfarë alarmi krijohet.

• AWS GuardDuty finding types.
• MITRE ATT&CK for Cloud.