Incident response guide for AWS CloudTrail investigations – Part 1

This guide uses two real-world CloudTrail-driven scenarios — targeted cross-account S3 deletions with ransomware implications, and console-credential-based CloudFormation deployment of cryptomining instances — to illustrate investigative techniques, key indicators (session names, source IPs, user agents, MFA status, sessionCredentialFromConsole), timelines, and practical response checklists for containment, impact assessment, and hardening.