SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection

GIAC Cloud Threat Detection (GCTD)
GIAC Cloud Threat Detection (GCTD)
  • In Person (5 days)
  • Online
30 CPEs
Cloud infrastructure provides organizations with new and exciting services to better meet the demands of their customers. However, these services bring with them new challenges, particularly for organizations struggling to make sense of the cloud native logs, keeping ahead of fast-moving development teams, and trying to learn how threats are adapting to cloud services. Securely operating cloud infrastructure requires new tools and approaches for better visibility into the cloud environment threat landscape, ability to capture appropriate data, and most importantly to be able to analyze and correlate the data effectively and accurately to understand if the specific threat is legitimate based on your organization's bigger picture. 20 Hands-On Labs + CTF

What You Will Learn

Attackers can run but not hide. Our radar sees all threats.

SEC541 is an essential course on cloud threat detection, cloud security monitoring, and security analysis. Throughout the course, you will learn how to analyze attacker techniques and gain a deeper understanding of how they operate within cloud environments. Additionally, you'll explore the capabilities of cloud logging and security tools, learning how to use them effectively to detect and respond to potential threats. The course also discusses detection engineering in the cloud, which will give you a thorough understanding of creating robust and efficient threat detection systems. By the end of the course, you will have the skills and knowledge needed to analyze attacks and build a robust security engineering program.

At the beginning of each section in SEC541, you'll participate in an in-depth analysis of a real-world attack campaign that targeted AWS or Azure cloud infrastructure. This analysis will break down the attack's tactics and techniques, enabling you to understand how it happened and what could have been done to detect it. After analyzing the attacks, the course will teach you how to leverage cloud-native and cloud-integrated capabilities to detect, hunt, or investigate similar attacks in a real environment. You'll learn to build your arsenal of analytics, detections, and best practices, with a focus on using AWS and Azure services to analyze logs and behaviors. By the end of the course, you'll have gained a deep understanding of how to analyze and detect cloud-based threats and will be equipped with practical skills to apply to your cloud infrastructure.

"The course contains must-have knowledge to start with the threat hunting job in AWS/Azure." - Mikolaj Staniucha, PepsiCo

Business Takeaways

  • Decrease the average time an attacker is in your cloud environment.
  • Help your organization properly set up logging and configuration for improved detection engineering.
  • Decreases the risk of costly attacks by understanding and leveraging cloud-specific security services.
  • Lessen the impact of breaches that do happen.
  • Learn how to fly the plane, not just the ability to read the manual.

Skills Learned

  • How to research attacks and threats to cloud infrastructure
  • Break down a threat into detectable components.
  • Understand approaches for improved detection engineering.
  • Effectively use AWS and Azure core logging services to detect suspicious behaviors.
  • Use cloud-native API logging as the newest defense mechanism in cloud services.
  • Move beyond the cloud-provided web consoles to perform complex analysis.
  • Perform network analysis with cloud network logging.
  • Understand how application logs can be collected and analyzed inside the cloud environment.
  • Effectively put into practice the AWS and Azure security-specific services.
  • Integrate container, operating system, and deployed application logging into cloud logging services for more cohesive analysis.
  • Perform an inventory of cloud resources and sensitive data using scripts and cloud-native tooling.
  • Analyzing Microsoft 365 activity to uncover threats.
  • Ability to leverage cloud-native architecture to automate response actions to attacks.

Hands-on Training

The labs in this course are hands-on explorations into AWS and Azure logging and monitoring services. About 70% of labs are AWS and 30% Azure.

Each lab will start by researching a particular threat and the data needed to detect it. In most labs, the students will conduct the attack against their accounts, generating the logs and data needed to perform analysis. Students will use native AWS & Azure services and open-source products to extract, transform, and analyze the threat. The course lecture coupled with the labs will give students a full picture of how those services within AWS & Azure work, the data they produce, common ways to analyze the data, and walk away with the ability to discern and analyze similar attacks in their own cloud environment.

  • Section 1: SEC541 environment deployment, analyzing cloud API logs with CloudTrail, parsing JSON-formatted logs with JQ, network analysis
  • Section 2: Environment setup, application/OS log lab with OpenCanary, CloudWatch agent and customization, strange ECS behavior, finding data exfiltration
  • Section 3: Metadata services and GuardDuty, cloud inventory, discovering sensitive data in unapproved location with Macie, vulnerability assessment with Inspector, data centralization with Graylog
  • Section 4: Microsoft 365 Exchange investigation, introduction to Kusto Query Language, log analytics analysis using Azure CLI, Microsoft Defender for Cloud and Sentinel, Azure network traffic analysis
  • Section 5: Setup the automate forensics workflow, analyze the results, participate in the CloudWars Challenge

"Using the labs was easy with well documented instructions. I like the fact that I could easily copy and paste the commands. This helps me to get through the lab fast but I also know that I can come back later after the course and take the time to review each command." - Ludek Suk, Accenture

"Labs are awesome, and they all work! Learning a ton from these." - Joe Cultrara

"The lab guide is very detailed. Allowing me to learn and understand what I was doing. They also provided us with sufficient time to complete the labs and we were never rushed into doing anything." - Sambit Sarkar, ICE Data Services

Syllabus Summary

  • Section 1: Detecting adversarial activity in your cloud environment through management plane and network logging & analysis.
  • Section 2: Dig deeper into your applications and compute systems running within the cloud environment.
  • Section 3: Understanding your deployed cloud environment to easily identify deviation from organizational policy and potential malice.
  • Section 4: Deep dive into Azure's ecosystem and the unique threats that can occur.
  • Section 5: Learn to automate response actions in your cloud environment and put your new skills to the test in a Capture the Flag event.

Additional Free Resources

What You Will Receive

  • Printed and electronic courseware
  • MP3 audio files of the complete course lecture
  • Access to virtual machine in the AWS cloud
  • Access to an Azure account

What Comes Next

Depending on your current job role or future plans, any of the following SANS courses could be an excellent follow-on to SEC541:

For additional cloud security training courses, please visit our main SANS Cloud Security curriculum page.

Syllabus (30 CPEs)

Download PDF
  • Overview

    SEC541 starts with an investigation into the attack of the developer services company, Code Spaces. The class will break down the attack and map each action to the MITRE ATT&CK framework.

    This leads to an investigation of the detection and logging capability most unique to Cloud Services, the Cloud API Service. The Cloud API is at the heart of most activity in the cloud and is the first best place to start for analysis and detection.

    The class then investigates network analysis options in AWS and Azure cloud services, understanding what data is available, what is missing, and some of the ways that network analysis could have been used to detect Code Spaces and similar attacks.

    • SEC541 Environment Deployment
    • Analyzing Cloud API logs with CloudTrail
    • Parsing JSON-Formatted Logs with JQ
    • Network Analysis


    Debrief: Code Spaces

    • Walkthrough of the attack on the developer services company, Code Spaces
    • Understanding threat-focused detection and analysis

    Cloud API Logging

    • Cloud API Logging overview
    • AWS CloudTrail service
    • Azure Activity Log
    • Log Parsing with JQ

    Cloud-Native Logging Services

    • AWS CloudWatch logging
    • CloudWatch Insights for analytics
    • Azure Log Analytics

    Network Flow Logging

    • AWS VPC Flow Logs
    • AWS Athena
    • Azure Flow Logs

  • Overview

    Section 2 starts with a dive into the attack against Tesla's Kubernetes management services. As with Section 1, the class will investigate the specific tactics used in the attack and how they map to MITRE's new Container ATT&CK Framework.

    Containers are becoming ever more common in cloud services, especially when they help common application development in multi-cloud or hybrid architectures. Section 2 starts with looking at how application logs can be gathered in AWS and Azure, at what level, and the types of data typically gathered. The class then looks at Kubernetes, Docker, AWS, and Azure container orchestration services, what data is logged, and how to investigate that log data to detect activity or help with investigations.

    The section rounds out by looking at proxies that operate in the cloud environment. Proxies have the promise of improving operations and maybe even security, but Cloud-managed proxies lose some visibility. The class will understand what services are available and how to make the most of the logging.

    • Section 2 environment setup
    • Application/OS log lab with OpenCanary
    • CloudWatch agent and customization
    • Strange ECS behavior
    • Finding data exfiltration


    Debrief Tesla Attack

    • Story Overview
    • Introduce MITRE Container Matrix
    • Discuss Threats to Container-based Deployments

    Making use of Operating System Logs

    • Windows operating system logs
    • Powershell logs
    • Linux logging

    Gathering Application Generated Logs

    • Web server logs
    • Database logs
    • Honeypots

    Log Agents

    • AWS CloudWatch Agent
    • Azure Log Analytics Agent

    Container Logs

    • Docker logging
    • Kubernetes logging
    • AWS ECS (EC2 and Fargate)
    • AWS EKS (EC2 and Fargate)
    • Azure Container Instances
    • Azure AKS

    Cloud Proxies

    • AWS proxy services
    • Azure proxy services
    • Content Delivery Networks
    • Storage access logs
  • Overview

    Section 3 starts with an investigation into the Capital One attack. After pulling apart the techniques used by the attacker, the class will look at how AWS cloud's metadata service can be used to gain unauthorized access to cloud infrastructure through application vulnerabilities, and what is different from Azure's implementation.

    After a discussion of AWS services that help with security monitoring, the section will discuss tools and cloud-managed services that are used to perform an inventory of resources and perform data discovery. Cloud environments are constantly changing, and the investigator needs these discovery tools to pinpoint problems quickly.

    AWS and Azure provide services to help with application, host, and configuration vulnerabilities that may point to potential intrusion and attacker activities. The class will look at some cloud company services build to help perform and remediate these vulnerabilities.

    Lastly, this section will discuss the benefits of centralizing the data collected from cloud, host, and application logs. The class will look at AWS and Azure services that help manage data centralization, which one to use, and their benefits.

    • Metadata services and GuardDuty
    • Cloud Inventory
    • Discovering sensitive data in unapproved location with Macie
    • Vulnerability assessment with Inspector
    • Data Centralization with Graylog


    Debrief: Capital One

    • Story Overview
    • AWS and Azure metadata services
    • AWS GuardDuty Overview

    AWS Cloud Inventory Techniques and Services

    • Command Line Discovery
    • AWS Configuration
    • Inventory with Azure

    Using Data Discovery Tools

    • Hunting data in cloud services
    • AWS System Manager
    • AWS Macie
    • Azure cognitive search

    Vulnerability Analysis Services

    • AWS Inspector
    • AWS Security Hub
    • Azure Security Center
    • AWS ECR

    Data Centralization

    • AWS Event Bus
    • AWS Kinesis Data Firehose

    AWS Elasticsearch

  • Overview

    Just like the first three sections, section 4 starts off with a review of the MalwareBytes breach from early 2021 and the major MITRE ATT&CK techniques involved. Afterwards, we will explore Microsoft 365, the components aiding defenders in their detection initiatives, and put our skills to the test using those techniques to discover the beginning of a new attack campaign in the first of five lab exercises.

    Next, and this is where section 4 differs, we will review a second breach: the SolarWinds supply chain attack from 2021. Afterwards, we dive more deeply into the Microsoft Azure ecosystem by learning the artifacts left behind - and the proper configuration steps - of Azure Active Directory. This will include a lab analyzing data using a language that was covered previously (but not yet exercised): Kusto Query Language.

    You will find, in the next few modules that round out the section, a continuation of what makes Azure quite different than most other cloud vendors: how their logging is handled related to cloud storage access, their unique detection services, and how network traffic can be analyzed. Each of these topics include a unique exercise to hone your skills.

    • Microsoft 365 Exchange Investigation
    • Introduction to Kusto Query Language
    • Log Analytics Analysis using Azure CLI
    • Microsoft Defender for Cloud and Sentinel
    • Azure Network Traffic Analysis


    MalwareBytes Attack

    • Story Overview

    Microsoft 365

    • Cloud productivity services discussion
    • Microsoft 365 Admin Centers
    • Microsoft Graph

    SolarWinds Attack

    • Story Overview

    Azure Active Directory (AD)

    • MITRE ATT&CK Azure AD Matrix
    • Azure AD Overview
    • Inventory of users and roles
    • Azure AD logging approaches
    • Analyze attacks against Azure AD

    Storage Monitoring

    • Overview of Azure Storage
    • Attacks against cloud storage
    • Analyzing Azure Storage logs and metrics

    Detection Services

    • Microsoft Defender of Cloud overview
    • Microsoft Sentinel overview
    • Continued discussion of cloud-specific threats
    • Identifying these threats using Microsoft-provided detection services

    Network Traffic Analysis

    • Azure Network Security Group (NSG) Flow Logs
    • Variable Packet Capture
    • Analysis of network-based attacks against cloud infrastructure

  • Overview

    The commercial cloud services are designed to automate the building and operation of complex workloads. We can leverage those automation design patterns to start automating the data capture, analysis, and security defenses in our environment. In this section, we will discuss some of the workloads we might want to automate in our cloud environment, investigate some of the services for automation, and then work through an example.

    This section also includes a CloudWars competition to reinforce the topics covered throughout the course. Through this friendly competition, you will answer several challenges made up of multiple choice, fill-in-the-blank, as well as hands-on and validated exercises performed in two CSP environments. You will also be given new cloud resources to deploy and analyze - earning valuable points in the process.

    • Automated Response Actions
    • CloudWars Challenge


    Automated Response Actions

    • Overview of automation services
    • Lay out response actions we may want to automate
    • Walk through an AWS automation example

    CloudWars Challenge

GIAC Cloud Threat Detection

The GIAC Cloud Threat Detection (GCTD) certification validates a practitioner's ability to detect and investigate suspicious activity in cloud infrastructure. GCTD-certified professionals are experienced in cyber threat intelligence, secure cloud configuration, and other practices needed to defend cloud solutions and services.

  • Detecting attacks in the cloud
  • Cloud investigations and cyber threat intelligence
  • Assessments and automation in AWS and Azure
More Certification Details


Students should be familiar with AWS or Azure and have worked with them hands-on, especially security professionals working in the cloud security field who understand basic threats and attack vectors.

The course assumes that students can understand or do the following without help:

  • Understand basic cloud resources such as virtual machines, storage services, and Identity Access Management
  • Hands-on experience in the command line, as much of the labs will be leveraging a Linux command line console.
  • Understand how identity access roles/policies work in cloud environments
  • Understand basic cloud networking capabilities

The natural prerequisite SANS courses for SEC541 are either:

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.


  • 8GB of RAM or more is required.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Additional requirements for this course:

  • Live and Live Online students will be provided with an AWS account for the duration of the class.
  • OnDemand students can request AWS and/or Azure accounts be provided for their use during the access period for the class.


  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact

Author Statement

"Cloud service providers are giving us new tools faster than we can learn how to use them. As with any new and complex tool, we need to get past the surface-level "how-to" in order to radically reshape our infrastructure. This course is an overview of the elements of AWS and Azure that we may have used before but are ready to truly explore. By the end of the class, you'll be confident knowing that you have the skills to start looking for the threats and building a true threat detection program in AWS and Azure."

Shaun McCullough and Ryan Nicholson

"I really enjoyed learning more about the AWS data sources and then performing relevant attacks against them to generate events that we could hunt for." - Gavin Knapp, Bridewell Consulting


This is a very well designed course. Shaun and Ryan did great work putting it together. The content is great and there's a lot to learn.
Scott Perry
These labs are great and have all the components of real world events and experience from both the attacker and defender/analyst -side of the practices.
Doug Wolk
Each day's content is like a well told story. The labs bring the lecture to life.
Frank Balluffi
BNY Mellon

    Register for SEC541

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.