NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cloud Security
Compromised Account Investigation
Master compromised account investigation. Learn to detect anomalous IAM activity, trace lateral movement, and execute advanced containment in cloud environments.
Room tasks
1What Is a Compromised Cloud Account Investigation and Why Does It Matter
2Identifying Anomalous API Calls & Role Assumption Chains
3Guided Lab: Investigating a Compromised IAM Credential
Frequently Asked Questions
How do you detect a compromised cloud account?
Look for unusual logins, new access keys, odd API calls, activity from unfamiliar locations and privilege changes. Cloud audit logs such as CloudTrail help reconstruct what the attacker did.
What are the first response steps?
Contain the account by disabling or rotating credentials, preserve logs and evidence, then trace actions and lateral movement. Finally remove persistence and review what data or resources were accessed.
Is this investigation room hands-on?
It teaches a practical workflow for detecting and tracing compromised identities in the cloud. The advanced room is free on Codelivly and suits learners with some incident response background.