Examples

# Defensive examples - controls + detections

> Concrete examples of defensive controls drawn from earlier lessons.

## 1. AWS - block public S3 by default (org level)

# AWS Organizations SCP
{
  'Version': '2012-10-17',
  'Statement': [{
    'Sid': 'DenyPublicBuckets',
    'Effect': 'Deny',
    'Action': [
      's3:PutBucketAcl',
      's3:PutAccountPublicAccessBlock'
    ],
    'Resource': '*',
    'Condition': {
      'StringEquals': {
        's3:x-amz-acl': ['public-read', 'public-read-write']
      }
    }
  }]
}


## 2. Sigma rule - office app spawning powershell

title: Office Spawning PowerShell
logsource: { category: process_creation, product: windows }
detection:
  selection:
    ParentImage|endswith:
      - '\\WINWORD.EXE'
      - '\\EXCEL.EXE'
      - '\\POWERPNT.EXE'
      - '\\OUTLOOK.EXE'
    Image|endswith: '\\powershell.exe'
  condition: selection
level: high


## 3. Kubernetes - NetworkPolicy default deny

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny, namespace: app }
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]


## 4. Web - secure headers (Express)

import helmet from 'helmet';
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'nonce-...'"],
      imgSrc: ["'self'", 'data:'],
      connectSrc: ["'self'", 'https://api.example.com'],
    }
  }
}));


## 5. GitHub Actions OIDC to AWS (no static keys)

permissions: { id-token: write, contents: read }
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::111111111111:role/GhActionsDeploy
      aws-region: ap-southeast-2


## 6. Detection - new IAM access key created

# CloudTrail filter
{ $.eventName = 'CreateAccessKey' }
# Alert ANY occurrence; rare and high-value

## 7. EDR - block USB autorun via Group Policy / MDM

# Disable USB autorun
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer
NoDriveTypeAutoRun (DWORD) = 255

## 8. Threat-modelled checklist - new microservice

- AuthN at the edge; AuthZ at the service
- Inputs validated with a schema (Zod, jsonschema)
- Egress denied by default; allowlist outbound endpoints
- Secrets in a manager (not env vars in plaintext)
- Logs without PII; structured + sampled
- Health + ready endpoints; graceful shutdown

# A pentest from end-to-end:
#   RoE signed → recon → enumeration → finding-by-finding test
#   → exploitation PoC → cleanup → report → debrief → retest.