detecting-compromised-cloud-credentials

Query GuardDuty for finding types like UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration, MaliciousIPCaller, and ConsoleLoginSuccess.B using the list-findings API. Include both OutsideAWS and InsideAWS exfiltration variants, since attackers proxying through another AWS account only trigger the InsideAWS variant.

Query the Microsoft Graph signIns endpoint filtering on riskLevelDuringSignIn or riskEventTypes_v2 for anonymized IP addresses. Note that risk-based detections require an Entra ID P2 license; without it, risk fields return empty and the queries silently produce no results.

GCP Data Access audit logs (DATA_READ/ADMIN_READ) are disabled by default per service, so queries on service account principal emails see nothing. Enable Data Access audit logging for the relevant services before trusting an empty result set.

Immediately deactivate access keys, revoke all active sessions, and force a password reset with MFA re-enrollment. Changing the password alone is insufficient because existing access keys and issued tokens remain valid until explicitly revoked or denied by policy.

A simple unique-IP-count heuristic misses low-and-slow abuse through a single residential proxy and false-positives on corporate NAT or VPN egress. Tune detection by allowlisting known corporate egress and VPN CIDR ranges before relying on the alerts.