Managed Detection & Response for AWS

Expel details a real-world AWS incident where attackers used stolen IAM access keys to enumerate S3, EC2, and RDS resources, add hundreds of Security Group ingress rules to expose services (including Postgres), create SSH key pairs and start an EC2 instance to gain command-line access; the post explains detection via CloudTrail and GuardDuty (with automated enrichment robots), investigative findings, containment steps (delete keys, remove SG rules, snapshot/rebuild instances), and recommendations to harden IAM and key management.