aws cloudtrail threat hunter

Hunt CloudTrail JSON exports for root use, no-MFA console logins, StopLogging, key creation, open security groups and mass secret reads.

Hunt AWS CloudTrail JSON exports offline for root use, console logins without MFA, IAM key and policy changes, StopLogging/DeleteTrail, security groups opened to the world, mass Secrets Manager reads, public AMI/snapshot shares and unusual regions. Writes a severity-ranked report, IOC CSV and timeline. Use when someone asks "were we breached in AWS?", "review this CloudTrail dump" or "who created this access key?".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.