domains / families / security / performing-cloud-forensics-with-aws-cloudtrail

performing-cloud-forensics-with-aws-cloudtrail

separate

Investigate AWS account compromise by querying CloudTrail with boto3's LookupEvents

When to use

• When investigating suspected AWS account compromise
• After detecting unauthorized API calls or credential exposure
• During incident response involving cloud infrastructure
• When analyzing S3 data exfiltration or IAM privilege escalation
• For post-incident forensic timeline reconstruction

Skill page

Source