Incident response guide for AWS CloudTrail investigations – Part 1

This incident response guide teaches investigators how to analyze AWS CloudTrail logs to uncover unauthorized access, cryptocurrency mining, and AI service abuse through real-world scenarios and forensic techniques.

• Scenario 1: Cross-account S3 data deletion with ransomware implications—threat actors assumed roles, enumerated buckets, exfiltrated data, then systematically deleted high-value files within 13 seconds
• Scenario 2: Cryptocurrency mining via CloudFormation—stolen console credentials without MFA enabled deployment of mining instances in production VPCs through CloudShell
• Key CloudTrail fields to examine: session names, source IPs, MFA status, user agents, timing patterns, and event chains revealing threat actor intent
• Investigation priorities: determine active access status, assess data exposure scope, identify blast radius across accounts and regions
• Response checklists for cross-account access review, authentication event analysis, backup recovery, and detection rule development
• MFA enforcement, cost monitoring, and least-privilege access are critical controls to prevent credential abuse and resource hijacking

Effective CloudTrail investigation requires understanding not just what happened, but how and why, enabling containment of immediate threats and closure of underlying security gaps.