Incident Response Guide for AWS CloudTrail Investigations - Part 2
AWS, Thursday, September 3rd, 2026
Part two continues AWS's CloudTrail investigation guide, building on the S3 ransomware and cryptomining scenarios from part one.
The second installment of AWS Security's CloudTrail incident response guide picks up from the two scenarios established in part one: cross-account Amazon S3 data deletion with ransomware implications, and cryptocurrency mining deployed through CloudFormation using exposed AWS Management Console credentials.
Where part one established terminology and investigative frameworks for analyzing CloudTrail events, part two continues the hands-on analysis of those incidents.
The guide is aimed at responders who need to move from a single suspicious event to the full scope of attacker activity in an AWS environment.