{"id":13821335,"url":"https://github.com/Netflix-Skunkworks/aws-credential-compromise-detection","last_synced_at":"2025-05-16T12:33:11.690Z","repository":{"id":62795045,"uuid":"142919428","full_name":"Netflix-Skunkworks/aws-credential-compromise-detection","owner":"Netflix-Skunkworks","description":"Example detection of compromise credentials in AWS","archived":false,"fork":false,"pushed_at":"2018-08-06T03:17:52.000Z","size":2083,"stargazers_count":122,"open_issues_count":0,"forks_count":17,"subscribers_count":120,"default_branch":"master","last_synced_at":"2025-04-24T02:43:14.594Z","etag":null,"topics":["security"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Netflix-Skunkworks.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-07-30T19:29:53.000Z","updated_at":"2025-04-17T00:53:10.000Z","dependencies_parsed_at":"2022-11-06T18:46:38.283Z","dependency_job_id":null,"html_url":"https://github.com/Netflix-Skunkworks/aws-credential-compromise-detection","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Netflix-Skunkworks%2Faws-credential-compromise-detection","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Netflix-Skunkworks%2Faws-credential-compromise-detection/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Netflix-Skunkworks%2Faws-credential-compromise-detection/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Netflix-Skunkworks%2Faws-credential-compromise-detection/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Netflix-Skunkworks","download_url":"https://codeload.github.com/Netflix-Skunkworks/aws-credential-compromise-detection/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254530641,"owners_count":22086651,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["security"],"created_at":"2024-08-04T08:01:20.166Z","updated_at":"2025-05-16T12:33:07.719Z","avatar_url":"https://github.com/Netflix-Skunkworks.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# Detecting Credential Compromise in AWS\n\nThis following code is an example implementation of the method described [here](docs/us-18-Bengtson-Detecting-Credential-Compromise-In-AWS-wp.pdf)\n\n## Getting Started\n\nTo get started, clone the repository and `pip` install the package\n\n`pip install .`\n\n## Running the program\n\nTo understand what commands exist, run:\n\n`detect --help`\n\n```detect --help\nUsage: detect [OPTIONS]\n\n  Detect off instance key usage\n\nOptions:\n  -v, --verbosity LVL  Either CRITICAL, ERROR, WARNING, INFO or DEBUG\n  --config YAML        Configuration file to use.\n  --directory TEXT     Path to directory with CloudTrail files  [required]\n  --version            Show the version and exit.\n  --help               Show this message and exit.\n```\n\nCopy your CloudTrail to a local directory.  All files must be in the same folder.\n\nTo run the code over your local CloudTrail files, run the following command:\n\n`detect --verbosity INFO --directory \u003cpath_to_cloudtrail_files\u003e`\n\nYou should see something like the following output:\n\n```detect --verbosity INFO --directory /tmp/cloudtrail/\nDetecting AWS Key Usage off instance...\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0000Z_1gye90eoWO1b1QRG.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0005Z_LNYW3Mic2zLWETkX.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0010Z_7V7xcXO6UzW77LwK.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0015Z_LAJ1Yb1bNyYSWXXA.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0020Z_t9rx7kgzBtItJhMy.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0025Z_M0HzhcOov89xY6w3.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0030Z_CBWEoVc6o54WtOg0.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0035Z_ksL7pEasuX6bWPHX.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0040Z_LwJdh1z4HGTH0XJH.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0045Z_UWCcHKGZO8tndQxi.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0050Z_bKEN9jPfv0zTVph0.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0055Z_zj6ZG2zOPpCXKzJX.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0100Z_UiWFT9ORqfYtdppO.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T0105Z_mhO8z0wHjDupnp6Y.json.gz\n.......\nCompromised Credential: arn:aws:sts::123456789123:assumed-role/testRole1/i-asdf1234adsf1234a - Source IP: 67.178.52.232 \nCompromised Credential: arn:aws:sts::123456789123:assumed-role/testRole1/i-asdf1234adsf1234a - Source IP: 67.178.52.232 \nCompromised Credential: arn:aws:sts::123456789123:assumed-role/testRole1/i-asdf1234adsf1234a - Source IP: 67.178.52.232 \nCompromised Credential: arn:aws:sts::123456789123:assumed-role/testRole1/i-asdf1234adsf1234a - Source IP: 67.178.52.232 \n........\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2130Z_OR96it0GfXSDfECJ.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2135Z_FBudvwUxhu9dv1yh.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2140Z_w9fFoLIdlCXwnpgc.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2145Z_achBqdC1o6d6wnQG.json.gz\nPotential for a new IP to be seen: arn:aws:sts::123456789123:assumed-role/testRole2/i-1234asdf1224asdf1\n........\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2340Z_GqdLsMcsTkRRxWev.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2345Z_Ln5pCyldci0nn07X.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2350Z_hW7tWtYiwbbZdSqd.json.gz\nProcessing file: /tmp/cloudtrail/123456789123_CloudTrail_us-west-2_20180404T2355Z_q5nS1nqvbGwBN0yT.json.gz\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNetflix-Skunkworks%2Faws-credential-compromise-detection","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FNetflix-Skunkworks%2Faws-credential-compromise-detection","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FNetflix-Skunkworks%2Faws-credential-compromise-detection/lists"}