Audit Logging Gaps

What Is Audit Logging Gaps?

You cannot reconstruct what was never recorded. A trail that covers one region, or that the intruder was able to delete, answers no questions at the moment the questions get asked. This exercise is about the forensic dead end rather than the intrusion: work an incident with incomplete logs, then fix coverage and integrity so the same reconstruction succeeds.

What You'll Learn in Audit Logging Gaps

• A regional trail does not record other regions at all, and the attacker chooses the region.
• Logs stored in the account being logged can be deleted by whoever compromised it. Ship them somewhere the source account cannot reach.
• Integrity validation is what distinguishes a complete log from one that was quietly edited.
• Alert on changes to the logging configuration itself, because disabling logging hides everything that comes after it.

Audit Logging Gaps — Training Steps

1. Find the blind spots

   Bob already has a foothold in Voskrell's cloud from a stolen deploy key. Before he does anything noisy, he checks what would see him. He inspects the account's one audit trail.

2. Work where nothing watches

   Bob moves to eu-north-1, a region the trail does not cover, and launches a fleet of the largest compute instances he can. They are not for Voskrell - they run a cryptocurrency miner that pays out to his own wallet. Voskrell just gets the bill.

3. The fleet is earning

   The instances are configured to mine to Bob's pool. He checks the pool to confirm the theft is live: his workers are online and his wallet is filling, on Voskrell's compute.

4. Cut the one record that remained

   Even the us-east-1 trail might have caught something on the way in. Bob turns it off. Nothing stops him, and nothing raises an alarm.

5. Why is this invisible?

   Before the response, pin down what actually let Bob operate without a trace.

6. What did they touch?

   Finance flags a cloud bill five times its normal size. Security traces it to eight mining instances in eu-north-1 that nobody recognises. The question lands on Alice: how did they get in, and what else did they do?

7. The trail was already off

   Alice starts with the obvious question: was the trail even running? She checks its status.

8. The dead end

   Alice tries to reconstruct what the credential did. She asks the trail for the instance launches.

9. Coverage and integrity, not the break-in

   The intrusion is not the thing that failed here. Voskrell could not answer a single forensic question because of how the trail was set up.

10. Open the trail settings

    Alice opens CloudTrail in the console to fix the trail itself. The gaps that made this incident un-investigable are all one screen of settings.