Module 17: Cloud SOC — Defending Beyond the Perimeter

Cloud-native logging, attack patterns, and detection for AWS, Azure, and GCP.

4 lessons · 4 labs

Wazuh
Operation APT Breach

Investigate the cloud pivot — console login from 185.220.101.42, IAM keys, S3 policy changes.

Path

  1. 01
    Lesson

    Cloud Audit Trails

    AWS CloudTrail, Azure AD Sign-In Logs, GCP Audit Logs — cloud log sources, key fields, ingestion into Wazuh

  2. 02
    Lab

    Lab 17.1 — CloudTrail Log Analysis

    Analyze pre-loaded CloudTrail events in Wazuh: IAM user creation, policy changes, S3 bucket modification, unusual console login.

  3. 03
    Lesson

    Cloud Attack Patterns

    IAM privilege escalation, S3 bucket exposure, Lambda abuse, SSRF to IMDS, Azure AD token theft, GCP service account theft, cross-cloud lateral movement — mapped to ATT&CK Cloud matrix

  4. 04
    Lab

    Lab 17.2 — Cloud Attack Detection

    Browser-only: Given raw CloudTrail JSON events, identify attack techniques, map to ATT&CK Cloud matrix, write detection logic.

  5. 05
    Lesson

    Cloud Detection & Response

    CloudTrail-based Sigma rules, Azure Sentinel KQL, GCP Chronicle YARA-L, cloud-native containment, IR playbooks for compromised instances and stolen credentials

  6. 06
    Lab

    Lab 17.3 — Cloud IR Playbook

    Browser-only: Design containment steps, credential rotation plan, and evidence preservation strategy for a cloud breach scenario.

  7. 07
    Lesson

    Multi-Cloud Investigation

    Cross-cloud identity federation attacks, multi-cloud correlation techniques, unified timeline building, cross-cloud kill chain reconstruction

  8. 08
    Lab

    Lab 17.4 — Multi-Cloud Investigation

    Browser-only: Analyze cross-cloud JSON logs (CloudTrail + Azure Sign-In + GCP Audit), reconstruct multi-cloud attack, map to ATT&CK Cloud Matrix.