🧰 CloudTrail

The items that name it 7

• [tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers
  articleas tools2026-10-29

  AWS logging used to map LLM-proposed commands to events and to detect LLM-driven post-compromise activity.

• Datadog pathrunner: AWS IAM privilege escalation framework
  toolas classification.key entities2026-10-20
• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  articleas tools2026-09-17

  AWS service log source for EKS forensics

• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas tools2026-08-07

  AWS logging that cannot reconstruct S3 Vectors tampering because data events are off by default and payloads omit vector keys, embeddings and metadata.

• Cloud Threat Highlights: H1 2026
  writeupas tools2026-08-06

  AWS logging service used to detect stolen instance role credentials via OS/user-agent mismatch and CREDENTIALS_CODE flag.

• AWS Ransomware
  writeupas tools2024-02-21

  AWS logging service used by the DFIR investigators to trace attacker's reconnaissance and deletion actions (GetSendQuota, ListBuckets, GetBucketVersioning, GetBucketReplication, GetBucketObjectLockConfiguration, GetBucketLogging, GetBucketRequestPayment, GetAccelerateConfiguration, DeleteBucket)

• AWS EKS forensics: data sources and investigation tooling (Synacktiv)
  articleas tools

  Records AWS API activity, used to trace abuse of node IAM role or pod identities (IRSA/EKS Pod Identity) stolen from the cluster