├── AWS_CloudTrail_CheatSheet.pdf ├── AWS_CloudTrail_CheatSheet.png ├── LICENSE └── README.md /AWS_CloudTrail_CheatSheet.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/aws-cheatsheet/HEAD/AWS_CloudTrail_CheatSheet.pdf -------------------------------------------------------------------------------- /AWS_CloudTrail_CheatSheet.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/invictus-ir/aws-cheatsheet/HEAD/AWS_CloudTrail_CheatSheet.png -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 Invictus Incident Response 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # aws-cheatsheet 2 | A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering. 3 | If you see room for improvements please let us know via an issue or create a pull request. 4 | 5 | | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Exfiltration | Impact | 6 | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | 7 | | ConsoleLogin | StartInstance | CreateAccessKey | CreateGroup | StopLogging | GetSecretValue | ListUsers | AssumeRole | CreateSnapShot | PutBucketVersioning | 8 | | PasswordRecoveryRequested | StartInstances | CreateUser | CreateRole | DeleteTrail | GetPasswordData | ListRoles | SwitchRole | ModifySnapshotAttributes | RunInstances | 9 | | | Invoke | CreateNetworkAclEntry | UpdateAccessKey | UpdateTrail | RequestCertificate | ListIdentities | | ModifyImageAttribute | DeleteAccountPublicAccessBlock | 10 | | | SendCommand | CreateRoute | PutGroupPolicy | PutEventSelectors | UpdateAssumeRolePolicy | ListAccessKeys | | SharedSnapshotCopyInitiated | | 11 | | | | CreateLoginProfile | PutRolePolicy | DeleteFlowLogs | | ListServiceQuotas | | SharedSnapshotVolumeCreated | | 12 | | | | AuthorizeSecurityGroupEgress | PutUserPolicy | DeleteDetector | | ListInstanceProfiles | | ModifyDBSnapshotAttribute | | 13 | | | | AuthorizeSecurityGroupIngress | AddRoleToInstanceProfile | DeleteMembers | | ListBuckets | | PutBucketPolicy | | 14 | | | | CreateVirtualMFADevice | AddUserToGroup | DeleteSnapshot | | ListGroups | | PutBucketAcl | | 15 | | | | CreateConnection | | DeactivateMFADevice | | GetSendQuota | | | | 16 | | | | ApplySecurityGroupsToLoadBalancer | | DeleteCertificate | | GetCallerIdentity | | | | 17 | | | | SetSecurityGroups | | DeleteConfigRule | | DescribeInstances | | | | 18 | | | | AuthorizeDBSecurityGroupIngress | | DeleteAccessKey | | GetBucketAcl | | | | 19 | | | | CreateDBSecurityGroup | | LeaveOrganization | | GetBucketVersioning | | | | 20 | | | | ChangePassword | | DisassociateFromMasterAccount | | GetAccountAuthorizationDetails | | | | 21 | | | | | | DisassociateMembers | | | | | | 22 | | | | | | StopMonitoringMembers | | | | | | 23 | --------------------------------------------------------------------------------