will75g/soc-day16-aws-cloud-security-investigation

This repository is a written lab report for Day 16 of a SOC (Security Operations Center) analyst training series. It documents a hands on AWS cloud security investigation exercise using AWS CloudTrail to examine account activity and identify security misconfigurations. The scenario involves creating a CloudTrail trail, a logging service that records every action taken in an AWS account, and reviewing the resulting event history. The investigation analyzed 11 management events and found two problems. The first, classified as high severity, was that the root account, the master account with full access to all AWS services and resources, had been used without multi factor authentication enabled. The second finding was that log file validation was disabled, meaning someone could potentially alter the log records without detection. A third event that initially appeared suspicious, activity from a user named onboarding, was confirmed to be an automated AWS internal service, not a human. Each finding is mapped to the MITRE ATT&CK framework, a widely used reference for categorizing attacker tactics and techniques. The report also includes remediation recommendations: enable MFA on the root account, turn on log file validation, create a dedicated IAM admin user for daily tasks instead of using root, and enable AWS GuardDuty for automated threat detection. The repository contains the README write up alongside screenshots documenting each step of the investigation. It is structured as a learning exercise showing the workflow a cloud security analyst follows when investigating suspicious AWS activity. The full README is longer than what was shown.