This case focused on an AWS account compromise tied to a stolen access key exposed in a source code repository. The scenario was intentionally familiar: a credential had made its way into Git history, an attacker found it, and the resulting cloud activity left a trail across both the repository and AWS telemetry.

Filed by John Watson. Evidence sources: GitHub repository at /home/johnwatson/project-x and AWS CloudTrail logs.

Repository Secret Discovery

The first task was to determine whether the repository contained an exposed AWS access key. TruffleHog searches not only the current state of the repository but its history. The initial invocation failed because the tool expected an explicit Git URI rather than a plain relative path. Once pointed correctly with a file:// URI, the scan succeeded.

cd ~/project-x
trufflehog git file://$(pwd)

TruffleHog output:

Detector Type: AWS
Raw Result:    AKIAXKBAMZT7PIDJ7ILQ
File:          .aws/credentials
Commit:        7b761b2b16be402e811dc0e58abdcc3694f90716

The credential was not "in code" — it was in history. An organization may believe a secret has been removed because it no longer appears in the latest files, while an attacker can still recover it from historical commits.

Historical Commit Forensics

Once the relevant commit was identified, the next step was to move into that historical state and inspect the file directly. Detached HEAD state is useful in forensics: the goal is not to modify the repository, but to examine a prior version safely.

git checkout 7b761b2b16be402e811dc0e58abdcc3694f90716
cat .aws/credentials

That file revealed both the access key ID and the paired secret access key:

Access Key ID:     AKIAXKBAMZT7PIDJ7ILQ
Secret Access Key: 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

CloudTrail Table and Schema Inspection

The second half of the investigation moved from the terminal into the SQL interface. Before writing filters, the case required identifying the correct CloudTrail table and reviewing its field structure.

SHOW TABLES;
DESCRIBE aws_cloudtrail;

Relevant nested fields:

userIdentity.accessKeyId
eventSource
eventName
requestParameters.key

S3 Data Event Pivot

The goal was not just to find generic activity from the stolen key, but to identify the specific object retrieved from S3. That meant narrowing to S3 data events and looking specifically at GetObject activity tied to the compromised access key:

SELECT
  requestParameters.key
FROM aws_cloudtrail
WHERE eventSource = 's3.amazonaws.com'
  AND eventName = 'GetObject'
  AND userIdentity.accessKeyId = 'AKIAXKBAMZT7PIDJ7ILQ'
ORDER BY eventTime ASC
LIMIT 20;

File stolen from S3: gadgets.txt

Looking broadly for "AWS activity" would have produced noise. Looking specifically for S3 GetObject events tied to the stolen access key isolated the exfiltration path quickly and cleanly.

Confirmed Findings

Access Key ID:     AKIAXKBAMZT7PIDJ7ILQ
Secret Access Key: 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
Commit:            7b761b2b16be402e811dc0e58abdcc3694f90716
Stolen file:       gadgets.txt