detecting-compromised-cloud-credentials

# Detecting Compromised Cloud Credentials ## When to Use - When investigating alerts about unusual cloud API activity from unfamiliar locations - When building detection rules for credential theft and abuse across cloud environments - When responding to notifications from cloud providers about exposed credentials - When monitoring for credential stuffing or brute force attacks against cloud identities - When assessing the scope of a credential compromise after initial detection **Do not use** for preventing credential compromise (use MFA, credential rotation, and secrets management), for detecting application-level credential theft (use application security monitoring), or for endpoint credential harvesting detection (use EDR tools). ## Prerequisites - AWS GuardDuty enabled across all accounts and regions - Azure Defender for Identity and Entra ID Protection configured - GCP Security Command Center with Event Threat Detection enabled - CloudTrail, Azure Activity Log, and GCP Audit Log centralized for analysis - SIEM integration for cross-cloud correlation of credential abuse indicators - Threat intelligence feeds for known malicious IP ranges ## Workflow ### Step 1: Detect Credential Compromise Indicators in AWS Monitor GuardDuty findings and CloudTrail anomalies that indicate credential abuse. ```bash # List GuardDuty credential-related findings aws guardduty list-findings \ --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \ -...