# Compromised Account Investigation

> Master compromised account investigation. Learn to detect anomalous IAM activity, trace lateral movement, and execute advanced containment in cloud environments.

Canonical: https://codelivly.com/rooms/compromised-account-investigation
Last updated: 2026-09-27

| | |
|---|---|
| Level | Advanced |
| Category | Cloud Security |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This advanced module dives deep into investigating compromised cloud identities. You will learn to analyze control plane logs (like AWS CloudTrail and Azure Activity Logs) to trace attacker lateral movement, privilege escalation, and persistence mechanisms (such as rogue access keys or modified trust policies). The curriculum covers advanced containment techniques, including immediate session revocation, credential rotation, and neutralizing automated persistence, empowering you to lead complex, identity-focused incident response efforts with precision.

## Lessons

1. What Is a Compromised Cloud Account Investigation and Why Does It Matter (30 min)
2. Identifying Anomalous API Calls & Role Assumption Chains (30 min)
3. Guided Lab: Investigating a Compromised IAM Credential (30 min)

## Related

- [Learning path: Cloud Incident Response and Forensics](https://codelivly.com/learning-paths/cloud-incident-response-and-forensics)
- [All rooms](https://codelivly.com/rooms)