Individual skill
detecting-compromised-cloud-credentials
Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.
internal/tools/skills/data/threat-hunting/detecting-compromised-cloud-credentials/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,313
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- cloud-security Declared skill tag
- credential-compromise Declared skill tag
- threat-detection Declared skill tag
- guardduty Declared skill tag
- incident-response Declared skill tag
- anomaly-detection Declared skill tag
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Detecting Compromised Cloud Credentials
## When to Use
- When investigating alerts about unusual cloud API activity from unfamiliar locations
- When building detection rules for credential theft and abuse across cloud environments
- When responding to notifications from cloud providers about exposed credentials
- When monitoring for credential stuffing or brute force attacks against cloud identities
- When assessing the scope of a credential compromise after initial detection
**Do not use** for preventing credential compromise (use MFA, credential rotation, and secrets management), for detecting application-level credential theft (use application security monitoring), or for endpoint credential harvesting detection (use EDR tools).
## Detection Gaps & Validation
