Announcing Our First Azure Course: Getting Started with Microsoft Defender for Cloud
We’ve been focused on AWS security for a while now, but here’s the thing: many of you work in multi-cloud environments or have been asking…
Category: Incident Response
Content and resources related to Incident Response & Handling
How hackers use this AWS ransomware attack
There’s a “new” ransomware attack being used in AWS that you need to know about. But what is it, how does it work, and how can you defend agains…
AWS Detection Engineering with Grimoire
In a prior article, I showed you how to get started with a tool called Stratus Red Team to simulate adversaries by executing attacks against…
S3 Bucket Backdoor Attack Simulation with Stratus Red Team
Testing your AWS environment’s security measures and your blue team’s effectiveness is crucial, and the most effective way to do this is through simulated attacks.…
Incident Response Playbook – EC2 Cryptomining [Cheat Sheet]
You wake up tomorrow to a GuardDuty notification that there might be EC2 cryptomining activity going on in one of your AWS accounts. What’s your…
My AWS IAM access keys were exposed & exploited…what should I do? [Cheat Sheet]
My AWS access keys were exposed and are being exploited by a threat actor. What do I do?!?! Step 1: Don’t panic! I’ve got you.…
Incident response process
There’s been a security incident in your organization. What do you do? Panic? No ;)! You follow an incident response process. In this article, we’re…
Must-have AWS security monitoring & alerting [Cheat Sheet]
Most of us know that having visibility into our cloud accounts and resources is critical, but it can easily be overwhelming to implement. What should…
Disaster Recovery with BCP, COOP, and DRP
For the CompTIA Security+ exam, you need to be familiar with three terms that are related to disaster recovery: What do each of these terms…
Detecting and Terminating Malware in Real-time
For a webinar collaboration with a friend of mine, Ell Marquez, who works at Intezer, we wanted to demonstrate how web application vulnerabilities could be…