CrowdStrike CCCS cheat sheet

Shared responsibility model: the provider secures the cloud (physical hosts, hypervisor, managed-service internals); the customer secures what runs in the cloud (identity, data, configuration, guest OS). Managed services shift the boundary, not the accountability.

CSPM evaluates control-plane configuration against benchmarks (CIS, provider-native baselines); CWPP covers runtime and host-level posture. A finding in one does not imply coverage in the other.

Multi-account structure: the management/root account should hold only billing and organization controls; workloads and logging live in member accounts so a single compromise cannot reach the whole estate.

Immutable infrastructure means instances are replaced, not patched in place; detection must therefore baseline by image/AMI/container digest and treat drift from that digest as a signal.

Control-plane vs data-plane: API calls that create, modify, or delete resources are control-plane (CloudTrail management events); S3 object GET/PUT and similar are data-plane events and are often not logged by default.

Serverless and container runtimes shorten workload lifetime to seconds or minutes; telemetry must be streamed off-instance at creation time because the artifact disappears with the workload.

Cloud-native logging sources: CloudTrail (API audit), VPC Flow Logs (network metadata), GuardDuty (managed findings), Security Hub (aggregation) - each answers a different question and none replaces another.

Encryption posture has three separate decisions: at rest (KMS/CMK vs provider-managed key), in transit (TLS termination point), and key custody (who can decrypt). Auditors ask which of the three is customer-controlled.

Least privilege is evaluated on the effective policy: identity-based policy plus resource-based policy plus permissions boundary plus SCP/service control policy. The intersection, not any single document, defines what is allowed.

Explicit deny always wins in AWS IAM evaluation order: deny in any applicable policy overrides every allow, including an administrator allow.

Roles with temporary credentials (STS, instance profiles, workload identity federation) are preferred over long-lived access keys; a static key found in code or environment variables is a high-severity indicator.

Cross-account trust is a resource-policy decision: the trusting account's role trust policy must name the principal, and the caller must also be permitted by its own identity policy. Both sides must allow.

Privilege-escalation primitives to hunt for: iam:PassRole combined with compute creation, iam:CreatePolicyVersion, iam:AttachUserPolicy, sts:AssumeRole chains, and lambda:UpdateFunctionCode on a privileged function.

MFA deletion protection and short session durations limit the blast radius of a stolen console session; absence of MFA on a privileged principal is a finding, not a preference.

Service accounts and managed identities should be workload-scoped, not shared across applications; a single credential used by many workloads makes attribution impossible during response.

Permission proliferation shows up as unused grants: access advisor / last-accessed data older than the review window is the evidence base for rightsizing a policy.

Runtime sensor coverage is the gating metric: an instance or container without an agent produces configuration findings but no process-level telemetry, so EDR detections cannot fire on it.

Container protection layers: image scanning (pre-deploy), admission control (block non-compliant images), and runtime detection (process, file, network behavior inside the container). All three are distinct controls.

Indicators of container compromise: shell spawned inside an application container, unexpected outbound connections, writes to read-only layers, crypto-mining process names, and privilege escalation via mounted docker socket.

Linux workload detections rely on process ancestry and command line; a web server process (nginx, httpd, java) spawning a shell or a package manager is a high-fidelity signal regardless of payload.

Serverless functions have no host to instrument; protection depends on code/dependency scanning, function permission review, and control-plane auditing of deployment and configuration changes.

File integrity monitoring baselines critical paths (/etc/passwd, /etc/shadow, SSH authorized_keys, cron directories); change events there are weighted far above application-directory churn.

Vulnerability findings must be joined with exposure: an internet-reachable instance with a critical CVE and no compensating control outranks the same CVE on an isolated host.

Golden-image and registry provenance: workloads launched from unapproved images or registries, or images whose digest differs from the approved build, warrant investigation before runtime analysis.

Security groups are stateful and instance-level (allow rules only); network ACLs are stateless and subnet-level (allow and deny, evaluated in order). Return traffic must be explicitly permitted by an NACL.

VPC Flow Logs record metadata only - 5-tuple, bytes, packets, action, and timestamps - never payload. They support traffic-baselining and exfiltration hunting, not content inspection.

Flow-log fields to pivot on: REJECT entries (scanning or blocked attempts), high byte counts from a single internal host to an external IP (exfiltration), and unusual destination ports (C2 over non-standard ports).

Egress control is the recurring gap: default allow-all outbound permits C2 and exfiltration. Restricting egress to known destinations via proxy, NAT with policy, or endpoints is the mitigation.

Private connectivity (PrivateLink, VPC endpoints, private peering) removes traffic from the public internet, but it also removes it from internet-facing inspection tools; visibility must be re-instrumented.

Public exposure review: an internet-facing load balancer, a public S3 bucket policy, or a security group open on 0.0.0.0/0 to a management port (22, 3389, 3306) is a direct exposure finding.

DNS is a high-value visibility source: query logging reveals beaconing domains, DNS tunneling (long labels, high query volume to one domain), and resolution of newly registered domains.

Cloud attack sequence to detect: credential discovery (STS GetCallerIdentity, ListUsers), privilege escalation, persistence (new access key, new role trust, Lambda backdoor), then resource abuse (crypto-mining, data access).

Defense evasion signals: CloudTrail stopped or trail deleted, GuardDuty detector disabled, log-bucket policy loosened, KMS key scheduled for deletion, and region hopping to unmonitored regions.

Isolation in the cloud is not unplugging a cable: replace the security group with a deny-all forensic group, snapshot disks and memory, and preserve the instance rather than terminating it.

Credential compromise response order: revoke or deactivate keys, invalidate sessions, rotate the role trust, then scope the blast radius from CloudTrail - do not delete the principal before collecting its activity.

Evidence preservation: copy CloudTrail, flow logs, and snapshots to a separate, write-protected forensic account with its own retention; the compromised account's logs are attacker-modifiable.

Compliance evidence maps controls to artifacts: encryption to KMS key policy and config rules, access review to IAM credential reports, logging to trail configuration and retention settings.

Frameworks in scope for cloud audits: SOC 2 (trust services criteria), ISO 27001/27017, PCI DSS, HIPAA, and CIS Benchmarks as the technical baseline; each maps to a different evidence set.

Mean time to detect depends on log latency and ingestion path; a detection that reads logs hours after the event cannot meet a minutes-level response SLA regardless of rule quality.

Shared responsibility split: provider owns physical, hypervisor, and managed-service internals; customer owns identity, data, configuration, and guest OS.

CSPM checks control-plane configuration against benchmarks; CWPP covers runtime and host posture. Coverage in one does not imply the other.

Management/root account holds billing and org controls only; workloads and logs live in member accounts to limit blast radius.

Control-plane events are resource create/modify/delete API calls; data-plane events are object reads and writes and are often unlogged by default.

Ephemeral workloads require telemetry streamed at creation; the instance artifact disappears with the workload.

Encryption decisions are three separate questions: at rest, in transit, and key custody (who can decrypt).

Effective permission is the intersection of identity policy, resource policy, permissions boundary, and SCP; explicit deny overrides every allow.

Cross-account access requires the trusting role policy and the caller's identity policy to both allow.

Privilege-escalation primitives: iam:PassRole plus compute creation, CreatePolicyVersion, AttachUserPolicy, sts:AssumeRole chains, lambda:UpdateFunctionCode.

Static long-lived access keys are a high-severity indicator; prefer roles and workload identity federation.

Unused grants (last-accessed data beyond the review window) are the evidence base for rightsizing policies.

Shared service accounts across workloads destroy attribution during incident response.

No runtime sensor means no process telemetry; configuration findings still appear but EDR detections cannot fire.

Container protection is three controls: image scanning, admission control, and runtime process/file/network detection.

High-fidelity Linux signal: a web server process spawning a shell or package manager, regardless of payload.

File integrity monitoring weights changes to /etc/passwd, /etc/shadow, authorized_keys, and cron above application churn.

Serverless has no host to instrument; rely on dependency scanning, permission review, and control-plane auditing.

Join vulnerability findings with internet exposure to rank true risk.

Security groups are stateful and instance-level (allow only); NACLs are stateless and subnet-level with ordered allow and deny rules.

VPC Flow Logs capture 5-tuple metadata only, never payload; use them for baselining and exfiltration hunting.

Pivot on REJECT entries, large internal-to-external byte counts, and non-standard destination ports.

Default allow-all egress permits C2 and exfiltration; restrict egress to known destinations or a proxy.

Private endpoints remove traffic from the public internet and from internet-facing inspection; re-instrument visibility.

DNS query logging reveals beaconing, tunneling, and newly registered domain resolution.

Attack chain order: credential discovery, privilege escalation, persistence via new keys or role trust, then resource abuse.

Evasion signals: trail stopped or deleted, detector disabled, log bucket policy loosened, KMS key scheduled for deletion, region hopping.

Isolation means deny-all forensic security group plus disk and memory snapshots; preserve the instance, do not terminate.

Credential response order: revoke keys, invalidate sessions, rotate trust, then scope blast radius from CloudTrail before deleting the principal.

Copy evidence to a separate write-protected forensic account; the compromised account's logs are attacker-modifiable.

Log latency bounds achievable detection time; hours-late ingestion cannot meet a minutes-level response SLA.

Shared responsibility: provider secures the cloud; customer secures what runs in it, including identity, data, and configuration.

CSPM covers control-plane configuration; CWPP covers runtime and host posture. They are separate coverage domains.

Multi-account design keeps the root account to billing and organization controls so one compromise cannot reach the estate.

Immutable infrastructure requires baselining by image or container digest; drift from the digest is a detection signal.

Stream telemetry off ephemeral workloads at creation; the instance artifact disappears with the workload.

Encryption at rest, in transit, and key custody are three separate audit questions.

Effective permission is the intersection of identity policy, resource policy, permissions boundary, and SCP.

Explicit deny in any applicable policy overrides every allow, including administrator allows.

Both sides must allow cross-account access: the trusting role policy and the caller's identity policy.

Hunt privilege escalation via PassRole plus compute creation, CreatePolicyVersion, AttachUserPolicy, and AssumeRole chains.

Static access keys in code or environment variables are a high-severity indicator; prefer roles and federation.

Last-accessed data beyond the review window is the evidence for rightsizing a policy.

Runtime sensor coverage gates EDR: without an agent, configuration findings appear but no process detections fire.

Container protection requires image scanning, admission control, and runtime detection; each is a distinct control.

A web server process spawning a shell or package manager is high-fidelity regardless of payload.

File integrity monitoring weights /etc/passwd, /etc/shadow, authorized_keys, and cron above application churn.

Serverless protection relies on dependency scanning, permission review, and control-plane auditing, not host agents.

Rank vulnerabilities by internet exposure and compensating controls, not CVE severity alone.

Security groups: stateful, instance-level, allow rules only. NACLs: stateless, subnet-level, ordered allow and deny.

Flow logs record 5-tuple, bytes, packets, action, and timestamps; never payload content.

Exfiltration hunting pivots on high byte counts from one internal host to an external IP.

Default allow-all egress enables C2 and exfiltration; restrict to known destinations or a proxy.

Private connectivity removes traffic from internet-facing inspection; visibility must be re-instrumented.

DNS query logging exposes beaconing, tunneling, and resolution of newly registered domains.

Detect the chain: credential discovery, privilege escalation, persistence, then resource abuse such as crypto-mining.

Evasion signals include trail deletion, detector disablement, loosened log-bucket policy, and region hopping.

Cloud isolation uses a deny-all forensic security group plus disk and memory snapshots; never terminate the instance.

Preserve evidence in a separate write-protected forensic account; compromised-account logs are attacker-modifiable.

Compliance evidence maps controls to artifacts: KMS key policy, credential reports, trail configuration and retention.

Detection latency is bounded by log ingestion; hours-late logs cannot support a minutes-level response SLA.

Provider secures physical hosts and hypervisor; customer secures identity, data, configuration, and guest OS.

CSPM and CWPP are separate coverage domains; a finding in one does not imply the other.

Keep the management account to billing and organization controls; place workloads and logs in member accounts.

Control-plane API calls create, modify, and delete resources; data-plane object reads and writes are often unlogged by default.

Ephemeral workloads require telemetry streamed at creation because the artifact disappears.

At-rest encryption, in-transit encryption, and key custody are three distinct audit questions.

Effective permission is the intersection of identity policy, resource policy, permissions boundary, and SCP.

Explicit deny overrides every allow in any applicable policy.

Cross-account trust requires both the trusting role policy and the caller's identity policy to allow.

Privilege escalation: PassRole with compute creation, CreatePolicyVersion, AttachUserPolicy, AssumeRole chains.

Long-lived static keys are a high-severity indicator; prefer roles and workload identity federation.

Unused grants beyond the review window are the evidence base for rightsizing.

Without a runtime sensor, configuration findings appear but process-level EDR detections cannot fire.

Container protection needs image scanning, admission control, and runtime detection as three distinct controls.

Web server processes spawning shells or package managers are high-fidelity signals regardless of payload.

File integrity monitoring weights credential and cron paths above application directory churn.

Serverless protection relies on dependency scanning, permission review, and control-plane auditing.

Join vulnerability findings with internet exposure to rank actual risk.

Security groups are stateful and instance-level with allow rules; NACLs are stateless and subnet-level with ordered allow and deny.

VPC Flow Logs capture 5-tuple metadata only, never payload, supporting baselining and exfiltration hunting.

Pivot on REJECT entries, large internal-to-external byte counts, and non-standard destination ports.

Default allow-all egress permits C2 and exfiltration; restrict egress to known destinations or a proxy.

Private endpoints remove traffic from internet-facing inspection tools; re-instrument visibility.

DNS query logging reveals beaconing, tunneling, and newly registered domain resolution.

Attack chain: credential discovery, privilege escalation, persistence via new keys or role trust, then resource abuse.

Evasion signals: trail deleted, detector disabled, log-bucket policy loosened, KMS key scheduled for deletion, region hopping.

Isolate with a deny-all forensic security group and snapshots; preserve the instance rather than terminating it.

Response order: revoke keys, invalidate sessions, rotate trust, then scope blast radius from CloudTrail.

Preserve evidence in a separate write-protected forensic account; compromised-account logs are modifiable.

Log latency bounds detection time; hours-late ingestion cannot meet a minutes-level response SLA.

Shared responsibility: provider secures the cloud, customer secures what runs in it.

CSPM covers control-plane configuration; CWPP covers runtime and host posture.

Keep the management account to billing and organization controls only.

Control-plane API calls create, modify, and delete resources; data-plane reads and writes are often unlogged.

Stream telemetry at creation for ephemeral workloads; the artifact disappears with them.

Encryption at rest, in transit, and key custody are separate audit questions.

Effective permission is the intersection of identity policy, resource policy, permissions boundary, and SCP.

Explicit deny overrides every allow in any applicable policy.

Cross-account access requires the trusting role policy and the caller's identity policy to both allow.

Privilege escalation: PassRole plus compute creation, CreatePolicyVersion, AttachUserPolicy, AssumeRole chains.

Static long-lived keys are a high-severity indicator; prefer roles and federation.

Last-accessed data beyond the review window evidences unused grants.

No runtime sensor means no process telemetry; EDR detections cannot fire.

Container protection is image scanning, admission control, and runtime detection as distinct controls.

Web server processes spawning shells or package managers are high-fidelity signals.

File integrity monitoring weights credential and cron paths above application churn.

Serverless protection relies on dependency scanning, permission review, and control-plane auditing.

Rank vulnerabilities by internet exposure and compensating controls, not severity alone.

Security groups are stateful and instance-level; NACLs are stateless and subnet-level with ordered rules.

VPC Flow Logs capture 5-tuple metadata only, never payload.

Pivot on REJECT entries, large outbound byte counts, and non-standard destination ports.

Default allow-all egress permits C2 and exfiltration; restrict egress to known destinations.

Private endpoints remove traffic from internet-facing inspection; re-instrument visibility.

DNS query logging reveals beaconing, tunneling, and newly registered domains.

Chain order: credential discovery, privilege escalation, persistence, then resource abuse.

Evasion signals: trail deleted, detector disabled, log-bucket policy loosened, region hopping.

Isolate with a deny-all forensic security group and snapshots; preserve the instance.

Response order: revoke keys, invalidate sessions, rotate trust, then scope blast radius from CloudTrail.

Preserve evidence in a separate write-protected forensic account.

Log latency bounds detection time; hours-late ingestion misses minutes-level SLAs.

Provider secures physical and hypervisor layers; customer secures identity, data, configuration, and guest OS.

CSPM and CWPP are separate coverage domains.

Keep the management account to billing and organization controls only.

Control-plane API calls create, modify, and delete; data-plane reads and writes are often unlogged.

Ephemeral workloads need telemetry streamed at creation.

At-rest, in-transit, and key custody are separate audit questions.

Effective permission is the intersection of identity policy, resource policy, permissions boundary, and SCP.

Explicit deny overrides every allow in any applicable policy.

Cross-account access requires both the trusting role policy and the caller's identity policy to allow.

Privilege escalation: PassRole plus compute creation, CreatePolicyVersion, AttachUserPolicy, AssumeRole chains.

Static long-lived keys are a high-severity indicator; prefer roles and federation.

Unused grants beyond the review window evidence rightsizing.

Without a runtime sensor, configuration findings appear but process detections cannot fire.

Container protection needs image scanning, admission control, and runtime detection as distinct controls.

Web server processes spawning shells or package managers are high-fidelity signals.

File integrity monitoring weights credential and cron paths above application churn.

Serverless protection relies on dependency scanning, permission review, and control-plane auditing.

Join vulnerability findings with internet exposure to rank real risk.

Security groups are stateful and instance-level; NACLs are stateless and subnet-level with ordered rules.

Flow logs capture 5-tuple metadata only, never payload.

Pivot on REJECT entries, large outbound byte counts, and non-standard destination ports.

Default allow-all egress permits C2 and exfiltration; restrict egress to known destinations.

Private endpoints remove traffic from internet-facing inspection; re-instrument visibility.

DNS query logging reveals beaconing, tunneling, and newly registered domains.

Chain order: credential discovery, privilege escalation, persistence, then resource abuse.

Evasion signals: trail deleted, detector disabled, log-bucket policy loosened, region hopping.

Isolate with a deny-all forensic security group and snapshots; preserve the instance.

Response order: revoke keys, invalidate sessions, rotate trust, then scope blast radius from CloudTrail.

Preserve evidence in a separate write-protected forensic account.

Log latency bounds detection time; hours-late ingestion misses minutes-level SLAs.