Investigate Threats with Amazon Detective

As a leading Managed Security Services Provider (MSSP), we oversee the cybersecurity of our client, Huge Logistics, a global leader in the logistics sector. Today, we received a GuardDuty alert indicating a potential SSH brute force attack targeting one of their primary EC2 instances. Coincidentally, our monitoring systems flagged unusually high CPU utilization on the same instance. Given the potential criticality, we need your skills to investigate these anomalies, ensuring the digital integrity of Huge Logistics remains uncompromised.

• Basic Linux command line knowledge

• Using the AWS Console to investigate threats in Detective
• An understanding of how this scenario could have been prevented

Brute force attacks against EC2 instances, especially those targeting SSH (usually on port 22), are quite common. AWS's public IP address ranges are well-known, and password hygiene is generally quite poor. Script, bots and scanners are continuously running, attempting to identify services that suffer from known vulnerabilities or that can be subjected to online brute force attacks. Automated intrusion attempts can often be seen within the first 12 hours of a system being exposed to the internet. Interesting research reveals that Rapid7 detected approximately 500,000 unique passwords in their SSH and RDP honeypots, almost all (99.997%) were present in the well-known rockyou.txt wordlist (clicking the link will download it). This reveals that online attackers are relying exclusively on common wordlists when conducting brute force attacks. Make sure your password isn't in one of them! Once an attacker has compromised the SSH service, they can install crypto miners, backdoor executables for persistence, and look penetrate the rest of the cloud environment.