Hunting for signs of persistence in the cloud: an IR guide following the CircleCI incident

CircleCI disclosed a January 2023 security breach that exposed thousands of organizations' secrets; this report explains how attackers could leverage compromised cloud credentials to establish persistence across AWS, Azure, and GCP. It maps likely attacker TTPs (e.g., creating users/keys, updating function code, injecting startup scripts, creating service account keys), provides Athena/KQL/GCP logging queries to hunt for suspicious activity and known malicious IPs from the CircleCI incident, and lists remediation steps to remove backdoors and revoke malicious artifacts.