Skip to content

Instantly share code, notes, and snippets.

@invictus-ir

invictus-ir/CloudTrail.csv

Last active May 26, 2026 10:02
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save invictus-ir/06d45ad738e3cc90bc4afa80f6a72c0a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save invictus-ir/06d45ad738e3cc90bc4afa80f6a72c0a to your computer and use it in GitHub Desktop.
Download ZIP
An overview of CloudTrail events that are interesting from an Incident Response perspective
Raw
CloudTrail.csv
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Exfiltration Impact
ConsoleLogin StartInstance CreateAccessKey CreateGroup StopLogging GetSecretValue ListUsers AssumeRole CreateSnapShot PutBucketVersioning
PasswordRecoveryRequested StartInstances CreateUser CreateRole DeleteTrail GetPasswordData ListRoles SwitchRole ModifySnapshotAttributes RunInstances
Invoke CreateNetworkAclEntry UpdateAccessKey UpdateTrail RequestCertificate ListIdentities ModifyImageAttribute DeleteAccountPublicAccessBlock
SendCommand CreateRoute PutGroupPolicy PutEventSelectors UpdateAssumeRolePolicy ListAccessKeys SharedSnapshotCopyInitiated
CreateLoginProfile PutRolePolicy DeleteFlowLogs ListServiceQuotas SharedSnapshotVolumeCreated
AuthorizeSecurityGroupEgress PutUserPolicy DeleteDetector ListInstanceProfiles ModifyDBSnapshotAttribute
AuthorizeSecurityGroupIngress AddRoleToInstanceProfile DeleteMembers ListBuckets PutBucketPolicy
CreateVirtualMFADevice AddUserToGroup DeleteSnapshot ListGroups PutBucketAcl
CreateConnection DeactivateMFADevice GetSendQuota
ApplySecurityGroupsToLoadBalancer DeleteCertificate GetCallerIdentity
SetSecurityGroups DeleteConfigRule DescribeInstances
AuthorizeDBSecurityGroupIngress DeleteAccessKey GetBucketAcl
CreateDBSecurityGroup LeaveOrganization GetBucketVersioning
ChangePassword DisassociateFromMasterAccount GetAccountAuthorizationDetails
DisassociateMembers
StopMonitoringMembers
@LuisDeSantana

LuisDeSantana commented Jul 28, 2023

Copy link
Copy Markdown

Great work guys!

@christopherwatkins901

christopherwatkins901 commented Oct 30, 2023

Copy link
Copy Markdown

Thank you all for what you do!

@chourete

chourete commented Jun 9, 2025

Copy link
Copy Markdown

Great!
btw,
ListObjects?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment