Can you explain how attackers move laterally through an AWS cloud network and how to spot it using native logs.
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
Can you explain how attackers move laterally through an AWS cloud network and how to spot it using native logs.
2 real searches · 1 real-search pass
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
AWS CloudTrail userIdentity sessionContext AssumeRole eventName sourceIPAddress documentation GuardDuty lateral movement findings VPC Flow Logs AWS documentation Google ↗
AWS Security Hub detect lateral movement CloudTrail GuardDuty IAM anomalous behavior documentation Google ↗
- Understanding CloudTrail events · docs.aws.amazon.com
- CloudTrail userIdentity element · docs.aws.amazon.com
- Amazon GuardDuty Documentation · aws.amazon.com
- Intelligent Threat Detection – Amazon GuardDuty FAQs · aws.amazon.com
- Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation · aws.amazon.com.cdn.amazon.com
- Incident response guide for AWS CloudTrail investigations – Part 2 · aws.amazon.com
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
AWS CloudTrail userIdentity sessionContext AssumeRole eventName sourceIPAddress documentation GuardDuty lateral movement findings VPC Flow Logs AWS documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
AWS Security Hub detect lateral movement CloudTrail GuardDuty IAM anomalous behavior documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |