Principal pursuit and propose-only containment

Interceptor

Finds the intruder. Holds the line.

Give it one access key, role, session, IP address, or KMS key, and it follows that principal across an AWS organization through every session and role it reaches. It answers a responder's first questions in minutes: who this is, where the credentials came from, what else they hold now, what they are doing, and what they created that will outlive the credentials you just disabled. Then it drafts the containment, for your approver to run.

What it touches in your organization Start an engagement at vantalect.com
A matte-black robotic quadruped standing alert in a long, dark data center aisle.A matte-black robotic quadruped standing alert in a bright data center aisle under white light.

What it does

How it works.

  1. Takes one seed.

    An access key, a role or session ARN, a session name, an IP address, a KMS key, or an account outside your organization. A bare value is enough; it recognizes the kind.

  2. Follows the trail.

    Builds the session tree forward and backward across accounts and role chains. Every link records the key that joined two sessions and its confidence: high, medium, or inferred, with the reason.

  3. Marks what will outlive the key.

    Anything a followed session created that can act later (an IAM user or key, a role or trust change, a KMS grant, a Lambda function, a stack, an S3 Batch job) becomes a new seed from the moment it was made.

  4. Alerts on the moves that matter.

    Fifteen rules, PU-01 to PU-15: outside key material, a key policy opened to an outside principal, snapshot deletion bursts, trail tampering, IAM persistence, leaving the organization, and any action by a tainted principal.

  5. Drafts the containment.

    Nine containment proposals, CA-01 to CA-09, each an SSM Automation document with an approval step. A proposal is refused if it has no approver, names an operator as approver, puts a change before the approval, or ends without a verification read.

By design

What it never does.

  • Runs containment. It renders documents and imports no SDK for changes.
  • Acquires disk or memory, or decrypts anything.
  • Reads customer data.
  • Hides how fresh an event is: every view shows its source and the time it arrived.

Footprint

What it touches in your organization.

Forwarder
A CloudFormation StackSet you deploy to every member account and Region, plus a stack in the management account and a forwarder in us-east-1 in every account.
Central bus and queue
In your audit account: an event bus that accepts only your organization's forwarders, and an encrypted queue.
Roles
A read-only role it assumes; a containment role that SSM assumes only after your approver approves and that cannot edit its own policies; and an operator policy that can start only the containment documents you registered, at a pinned version.
Where the data lives
One case file on the Vantalect consultant's machine, with every AWS call written beside it, held under the engagement terms. Acumen Defensive holds none of it.
Compare every tool’s footprint

In Vantalect’s engagements

See it at work.

Wrenfield (a sample bank)

The Response, at Wrenfield

A control-plane attack on a sample bank, turned into CloudTrail records and followed by Interceptor from one stolen key to every session, account, and backdoor it reached. Vantalect's case study calls the tool by its former name, Pursuit.

CloudTrail records stored
124,498
credentials followed
48
attacker sessions followed
37
alert groups raised
59
checks against the scenario agree
43 of 43

Read how the trail was followed

  • AWS Incident Response and Breach Forensics: Interceptor is the primary tool. The pursuit tool follows the intruder across the control plane, the forensics tool examines the machines it touched, and the survey supplies the estate snapshot and rescans what the intruder reached.

Put the tools to work

Engagements run through Vantalect.

Acumen Defensive builds the tools and runs no engagements of its own. Vantalect delivers every engagement that uses them, with the scope and price of each published at vantalect.com.

Start an engagement at vantalect.com

Vantalect, LLC is a separate company that licenses and operates these tools.