Audit Logging Gaps

What Is Audit Logging Gaps?

Detection and forensics depend on a record that existed before anyone thought to ask a question. A CloudTrail trail configured for one region does not record the others, and the attacker picks the region. A trail stored in the compromised account can simply be switched off. You'll watch an intruder go dark, then hit the wall as investigator: instances were launched, and the trail has no record. The fix is multi-region coverage, log file validation, delivery to an account the source cannot reach, and an alarm on logging changes.

What You'll Learn in Audit Logging Gaps

• A regional trail does not record other regions at all, and the attacker chooses the region.
• Logs stored in the account being logged can be deleted by whoever compromised it. Ship them somewhere the source account cannot reach.
• Integrity validation is what distinguishes a complete log from one that was quietly edited.
• Alert on changes to the logging configuration itself, because disabling logging hides everything that comes after it.

Audit Logging Gaps — Training Steps

1. Find the blind spots

   Bob already has a foothold in Voskrell's cloud from a stolen deploy key. Before he does anything noisy, he checks what would see him. He inspects the account's one audit trail.

2. Work where nothing watches

   Bob moves to eu-north-1, a region the trail does not cover, and launches a fleet of the largest compute instances he can. They are not for Voskrell - they run a cryptocurrency miner that pays out to his own wallet. Voskrell just gets the bill.

3. The fleet is earning

   The instances are configured to mine to Bob's pool. He checks the pool to confirm the theft is live: his workers are online and his wallet is filling, on Voskrell's compute.

4. Cut the one record that remained

   Even the us-east-1 trail might have caught something on the way in. Bob turns it off. Nothing stops him, and nothing raises an alarm.

5. Why is this invisible?

   Before the response, pin down what actually let Bob operate without a trace.

6. What did they touch?

   Finance flags a cloud bill five times its normal size. Security traces it to eight mining instances in eu-north-1 that nobody recognises. The question lands on Alice: how did they get in, and what else did they do?

7. The trail was already off

   Alice starts with the obvious question: was the trail even running? She checks its status.

8. The dead end

   Alice tries to reconstruct what the credential did. She asks the trail for the instance launches.

9. Coverage and integrity, not the break-in

   The intrusion is not the thing that failed here. Voskrell could not answer a single forensic question because of how the trail was set up.

10. Open the trail settings

    Alice opens CloudTrail in the console to fix the trail itself. The gaps that made this incident un-investigable are all one screen of settings.