Ticket summary
On the morning of 19 August 2026 the Nordvale Systems cloud security team received several alerts against the production AWS account. An employee's AWS identity authenticated from an unfamiliar network and, shortly afterwards, generated IAM and account-level changes that are inconsistent with anything that identity has done before. Monitoring has also flagged new credentials, a permission change, and access to sensitive AWS services. You are the SOC analyst on the ticket: decide whether the account has been taken over, reconstruct what the operator did, find the persistence, size the impact, and recommend containment.
Nordvale Systems runs a single production AWS account (851725491209) in ap-south-1. Engineering, finance, operations and security staff all hold named IAM users with virtual MFA, and privileged work is supposed to go through dedicated roles — DeveloperRole, DeploymentRole, SecurityAuditRole, ProductionAdminRole and OrganizationAdminRole. The account holds production EC2 instances, RDS, Lambda functions, three S3 buckets and two Secrets Manager secrets.
The evidence package is a four-hour CloudTrail slice covering 08:00–12:00 UTC, plus an IAM and sign-in view and an STS and session view over the same trail, four synthetic security findings, IAM metadata for the principal the findings name, and metadata for an access key that did not exist when the window opened. Roughly 630 records in total, and most of them are ordinary work by six identities.
Nothing in the ticket tells you which identity was compromised, where the operator came from, how they raised their privileges, or what they left behind. Every one of those answers is in the telemetry, but no single event proves anything on its own — this account has legitimate IAM reads, legitimate role assumptions, legitimate AccessDenied results and legitimate CLI traffic in the same window. Build the baseline first, then decide what deviates from it.