Investigate Threats with Amazon Detective

What this lab covers

You receive a brute force alert against an EC2 instance and a separate report of unusual CPU load, and use Amazon Detective to determine whether the two are connected and whether the instance was actually compromised.

The lab is about triage rather than detection. The alert already fired, and the work is deciding whether it matters, which is where most security operations time is genuinely spent.

It assumes basic Linux command line knowledge and no prior AWS experience, and suits analysts as much as cloud engineers.

How Amazon Detective supports investigation

GuardDuty analyzes CloudTrail, DNS and network flow data to produce findings. A finding is a signal that something suspicious occurred, and it is deliberately tuned to report attempts as well as successes, which is why volume can be high and triage matters.

Detective ingests the same underlying data and builds a behavioral graph over time, so instead of a point-in-time alert you get the resource's activity before, during and after. That is the difference between knowing an alert fired and knowing whether anything changed.

The combination of a brute force alert and a jump in resource utilization is a recognizable pattern. Successful compromise of an internet-facing instance is very frequently followed by cryptomining, because it monetises access immediately and requires no further understanding of the environment.

How to detect this in your own environment

Treat unexplained resource utilization as a security signal, not only a cost or performance one. Sustained high CPU on an instance whose workload has not changed is one of the more reliable indicators of mining activity.

Correlate findings with behavior rather than triaging them individually. An alert with no subsequent behavioral change is usually noise, and one followed by new outbound connections or new processes is not.

Watch outbound network destinations. Mining requires communication with a pool, so unfamiliar sustained outbound connections from a server that normally talks to a short list of destinations is corroborating evidence.

How to prevent it

Do not expose SSH to the internet. Use a managed session service or a bastion, which removes the brute force surface entirely rather than trying to survive it.

Disable password authentication and use keys or short-lived certificates, so that even a reachable service cannot be brute forced in any meaningful sense.

Alert on cost and utilization anomalies. Mining shows up on the bill, and for many organizations the finance signal arrives before the security one, which is worth wiring into the same process.

Real-world context

Cryptomining remains one of the most common outcomes of opportunistic cloud compromise, because it converts access into money without the attacker needing to understand the victim's business. Scanning for exposed services is continuous and automated.

The financial impact is often larger than expected. Mining on cloud infrastructure bills the victim at cloud rates, so the cost of a compromise can substantially exceed anything the attacker earns from it.

The pattern maps to MITRE ATT&CK T1110 Brute Force, T1496 Resource Hijacking and T1078 Valid Accounts.

Applying this at work

• Audit which of your instances expose SSH or RDP to the internet and move them behind a managed session service.
• Disable password authentication on any remaining reachable service.
• Add alerting on sustained CPU anomalies and on unexpected cost increases per account.
• Confirm someone triages GuardDuty findings and that the triage includes checking whether behavior changed.
• Baseline outbound destinations for your servers so unfamiliar sustained connections stand out.

Frequently asked questions

What is the difference between GuardDuty and Detective?

GuardDuty produces findings when it sees suspicious activity. Detective builds a behavioral graph from the same data so you can see what a resource did before, during and after. One raises the question, the other answers it.

Why does cryptomining follow a successful brute force so often?

Because it monetises access immediately without the attacker needing to understand the environment. It is the default outcome of opportunistic, automated compromise of exposed infrastructure.

How do I stop SSH brute force attempts entirely?

Remove the exposure. A managed session service or bastion means there is no internet-facing SSH to attack, which is more effective than rate limiting or fail2ban style responses on a public service.

Do I need my own AWS account to practice this?

No. The lab runs in a live AWS environment that Pwned Labs provisions for you, so there is nothing to set up and no risk to your own infrastructure.

Which certification covers this in depth?

The Amazon Cloud Red Team Professional (ACRTP) covers AWS attack and detection paths in full, including IAM abuse and privilege escalation, and is assessed hands-on in a live AWS account.