Case 0007: AWS Intrusion via Leaked CI Credentials | Threat Hunting Labs

Investigate leaked CI credentials used against AWS cloud services, following CloudTrail and S3 access evidence across credential validation, role assumption, serverless persistence, secret access, and object retrieval.