Data Exfiltration Through CloudTrail
Published Wed, Dec 20th, 2023
Platforms
Summary
This scenario describes a potential data exfiltration technique using AWS CloudTrail. An attacker with access to CloudTrail logs could potentially extract sensitive information from logged events, including API calls and data modifications. This poses a risk to data confidentiality and could lead to unauthorized access to sensitive information.
Affected Services
CloudTrail
Remediation
Implement strict access controls for CloudTrail logs, use encryption, and regularly audit access to CloudTrail data. Consider using AWS CloudTrail Lake for centralized storage and analysis of logs.
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/korniko98
Entry Status
Stub (AI-Generated)
Disclosure Date
-
Exploitability Period
-
Known ITW Exploitation
-
Detection Methods
Monitor CloudTrail access logs for unusual patterns or high-volume data transfers. Implement alerting for suspicious API calls or frequent access to CloudTrail data from unexpected sources.
Piercing Index Rating
-
Discovered by
-
