MALWARE ANALYSIS ON AWS: SETTING UP A SECURE ENVIRONMENT

Summary from the TLDR InfoSec newsletter

Malware analysis environments have complex requirements as they must allow analysts to effectively analyze potentially malicious code while it is executing in the environment. This post proposes a process in which a security analyst gains access to an EC2 instance with no outbound connectivity via AWS Systems Manager Session Manager. The analyst then connects to malware samples through a gateway endpoint for S3 to download the malware and detonate it, and then they can use services such as CloudTrail and GuardDuty to monitor the behavior. The post provides a detailed setup checklist that covers policy, account setup, VPC design, instance configuration, storage, monitoring, IAM, and lifecycle considerations.