AWS CloudTrail

Reported Context (5)

was completed in minutes. A human analyst following the same investigation thread across AWS CloudTrail, S3 data events, and GitHub audit logs would spend hours context switching between platforms, writing Wiz Blue Agent Traces AWS and GitHub Data Exfiltration Attack
The timeline below details each step of the testing process with commentary about what actions appear in the default AWS CloudTrail logs. How AWS Quarantines Exposed IAM Credentials and How to Monitor the Response
While our research specifically focuses on AWS CloudTrail data, the methodology can be easily extended to audit logs from other cloud providers, software as a service (SaaS), Kubernetes and other environments. Researchers Map AWS Identity Behavior to Improve Cloud Threat Detection
AWS CloudTrail records API activity, while Amazon GuardDuty identifies suspicious behavior involving AWS resources and credentials. How to Detect AWS Access Key Compromise with Wazuh
Even with correct configurations, behavior can signal emerging threats. Using AWS CloudTrail, Darktrace / CLOUD: How to Reduce Data Exposure Risks in Amazon Bedrock Deployments

People (1)

MITRE ATT&CK (18)

Vendors (7)

Products (33)

Tools (7)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.