Skill UI

Detects unauthorized S3 mass downloads by correlating CloudTrail S3 events, GuardDuty findings, Macie alerts, and VPC logs, enabling security teams to spot cross-account transfers and respond swiftly.

Use Amazon Macie to automate discovery, classification, and protection of PII, financial, and credential data in S3 buckets; configure CLI/Terraform, custom identifiers, allow lists, and integrate findings into Security Hub and EventBridge for proactive risk response.

Implements an immutable backup workflow with Restic, S3-compatible Object Lock, and automated verification to harden ransomware protection and ensure reliable recovery testing.

Provides step-by-step procedures to detect and remediate misconfigured Amazon S3 buckets, including enabling public access blocks, auditing policies and ACLs, enforcing encryption, and automating fixes with AWS Config and Lambda for compliance or incident response scenarios.

Uses AWS Athena to define forensic tables and run queries against CloudTrail, VPC Flow, S3 access, and ALB logs, helping security teams detect unauthorized access, data exfiltration, lateral movement, and privilege escalation during incident investigations.

Provides step-by-step techniques for assessing AWS security, covering IAM enumeration, privilege escalation, SSRF metadata attacks, S3/Lambda exploitation, and red-team persistence workflows with recommended tools and commands.