Credential Exfiltration, CloudTrail Tampering, and a 72-Hour Reporting Clock
A payments company runs 90 AWS accounts under Organizations. GuardDuty is enabled in all regions, and an organization CloudTrail trail delivers to a central S3 bucket. The SOC has a 15-minute triage SLA and PCI DSS obligations, including one-year log retention and internal incident reporting within 72 hours. GuardDuty raises UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration for an EC2 instance role. The credentials are then used from a Tor exit node, and the role can read a bucket tagged as cardholder data. At the same time, CloudTrail in eu-west-1 shows StopLogging for a member account trail, and the account owner says it was a cost optimization. The SOC has no tested cloud IR runbook, and legal wants evidence preserved before containment. The incident commander is on a plane for the next hour.
1. What are your first 30 minutes, and what order do you use between evidence preservation and containment?
Read the worked answer
I would declare an incident and assign an acting incident commander. First, preserve volatile and control-plane evidence: copy the GuardDuty finding, CloudTrail events, and the StopLogging event to an evidence bucket with object lock, and snapshot the EC2 instance. Record who did what and when. I would also check whether the role credentials were used in other accounts or regions.
Containment should not wait indefinitely for perfect preservation. If cardholder data is being accessed, I would revoke the role's active sessions by attaching an explicit deny or deactivating the role, rotate associated credentials, and isolate the instance with a quarantine security group. I would re-enable the disabled trail in eu-west-1 and determine who stopped it. The order is preserve the minimum evidence needed, contain active access, then continue forensic collection.
Legal should be informed immediately, but the SOC should not promise a complete timeline if logs are missing. The StopLogging event is itself evidence of a control failure and must be documented.
2. What compliance and evidence obligations does this trigger, and how do you handle the missing logs?
Read the worked answer
This triggers PCI DSS incident-response, logging, and retention obligations. The organization needs a documented incident record, evidence of containment, and an internal report within 72 hours. Because cardholder data may be involved, legal and compliance must assess notification duties. Evidence should be stored with integrity controls: hashes, timestamps, restricted access, and an audit trail of who accessed it.
The missing CloudTrail logs in eu-west-1 are a serious gap. I would not fabricate a timeline. Instead, I would document the gap, identify the time window when logging was stopped, and use alternate sources: GuardDuty findings, S3 access logs or data events, VPC Flow Logs, application logs, and payer integration logs. I would also determine whether the StopLogging call was authorized and whether other trails or regions were affected.
Retention must be verified for the central bucket, not just assumed. If the organization trail is intact elsewhere, preserve those records. The final report should distinguish confirmed events from inferred events and state the limitations.
3. What changes should the SOC make to its cloud IR runbook and tabletop program after this event?
Read the worked answer
The SOC needs cloud-specific playbooks, not a generic malware runbook. At minimum: compromised instance credentials, CloudTrail tampering, S3 data exposure, and EKS compromise. Each playbook should define pre-authorized containment actions, evidence sources, escalation contacts, and legal/compliance notification triggers. The 15-minute triage SLA should include validation steps and an acting incident commander when the primary is unavailable.
I would add preventive controls: an SCP or organization trail policy that denies StopLogging and DeleteTrail on the organization trail, alerting on those API calls, and a central log archive with object lock. Automation can snapshot an instance, disable a role, and open an evidence folder, but a human should approve destructive actions.
Tabletops should test the exact failure modes seen here: missing regional logs, a cost-optimization excuse, and a legal hold before containment. Measure time to preserve evidence, time to revoke credentials, and time to produce a scoped timeline. Repeat until the runbook is exercised, not just written.