A dependency-free threat-hunting tool for AWS CloudTrail logs. Standard library only. Point it at exported CloudTrail events (a file, a directory, or stdin) and it flags the activity worth looking at: root usage, logins without MFA, IAM tampering, security-group exposure, and attempts to blind the logging. Each is mapped to a MITRE ATT&CK technique and sorted by severity.
Most CloudTrail "analysis" is grepping JSON or paying for a SIEM. I wanted a small, readable first pass I could run on an export during an investigation, and a place to encode the hunting rules I actually care about. It pairs with my aws-iam-privesc-finder: that one finds the attack paths, this one spots them being used.
python3 cloudtrail_hunter.py <path> [options]<path> is a CloudTrail JSON file, a directory of them, or - for stdin.
# A single exported log file
python3 cloudtrail_hunter.py events.json
# A directory, only HIGH+ findings
python3 cloudtrail_hunter.py logs/ --min-severity HIGH
# Straight from the API
aws cloudtrail lookup-events --max-results 50 | python3 cloudtrail_hunter.py - --json| Flag | Description | Default |
|---|---|---|
--min-severity |
Only report at/above CRITICAL|HIGH|MEDIUM|LOW |
LOW |
--json |
Emit results as JSON | off |
It accepts the standard {"Records": [...]} file shape, the
aws cloudtrail lookup-events {"Events": [...]} shape, and a bare JSON array.
| Detection | Severity | MITRE |
|---|---|---|
| Root account used | CRITICAL | T1078.004 |
StopLogging / DeleteTrail / GuardDuty detector deleted |
CRITICAL | T1562 |
| Console login without MFA | HIGH | T1078 |
IAM escalation (CreateAccessKey, AttachUserPolicy, …) |
HIGH | T1098 |
Security group opened to 0.0.0.0/0 |
HIGH | T1190 |
| Failed console login | MEDIUM | T1110 |
AccessDenied / unauthorized calls (possible recon) |
LOW | T1078 |
Exit status is 1 when anything is found, so it can gate a pipeline.
This is a heuristic first pass, not a SIEM. It reads exported events; it does no correlation across time windows or baselining yet (see the roadmap idea of burst detection on failed logins and access-denied spikes).