misconfigured.io

Howdy

Welcome to misconfigured.io — a blog about cloud security, detection & response, and DFIR.

It's mostly a place for me to write things down and learn as I go — incident notes, detections, the occasional tool. Still taking shape.

Thanks for stopping by, cheers!

Query of the Week

Root account activity

SQL · Athena over CloudTrail

The root account shouldn’t be doing much of anything day to day, so anything it does is worth a look. This pulls the last 30 days of root activity — tune the window and add filters once you know your baseline.

SELECT
  eventtime,
  eventname,
  eventsource,
  sourceipaddress,
  useragent
FROM cloudtrail_logs
WHERE useridentity.type = 'Root'
  AND from_iso8601_timestamp(eventtime) > date_add('day', -30, now())
ORDER BY eventtime DESC;
all queries →

The Latest