Threat-Hunting AWS Credential Access Using Claude Code + CloudTrail MCP

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudtrail:LookupEvents",
        "cloudtrail:ListEventDataStores",
        "cloudtrail:GetEventDataStore",
        "cloudtrail:StartQuery",
        "cloudtrail:DescribeQuery",
        "cloudtrail:GetQueryResults"
      ],
      "Resource": "*"
    }
  ]
}

uvx awslabs.cloudtrail-mcp-server --help

{
  "mcpServers": {
    "cloudtrail": {
      "command": "uvx",
      "args": ["awslabs.cloudtrail-mcp-server"],
      "env": {
        "AWS_PROFILE": "threat-hunt-readonly",
        "FASTMCP_LOG_LEVEL": "ERROR"
      },
      "transportType": "stdio"
    }
  }
}

claude

/mcp

You are a cloud threat hunter. Use the CloudTrail MCP server to search for GetCallerIdentity 
calls in the past 30 days.

For each result, check:
1. Is the source IP in an expected range for this account (CI/CD systems, developer offices)?
2. Does the user agent match expected tooling (aws-cli, boto3, Terraform)?
3. Is the call timing outside business hours?

Flag any call where source IP is unexpected OR user agent is unusual.
Output a table: timestamp | principal | source IP | user agent | flag reason

Do not modify any file outside hunt-results/.

You are a cloud threat hunter. Use the CloudTrail MCP server to search for IAM enumeration 
events in the past 7 days.

Target events:
- iam:ListUsers
- iam:ListRoles  
- iam:GetAccountSummary
- iam:ListAttachedUserPolicies
- iam:ListAttachedRolePolicies

Flag any principal that called 3+ of these actions within a 10-minute window.
Output: principal | events called | window start | window end | source IP

Do not modify any file outside hunt-results/.

You are a cloud threat hunter. Use the CloudTrail Lake MCP server to find AssumeRoleWithWebIdentity 
calls where the same role was assumed from two different network locations in the same day.

Query logic:
- Find all AssumeRoleWithWebIdentity events in the past 14 days
- Group by roleArn and date
- Flag roleArns that appear with more than one distinct source IP block (/24)
- Separate CI/CD ASNs (GitHub Actions: 140.82.0.0/16, GitLab: 34.74.0.0/16) from all others

Output: roleArn | ci_cd_ip | external_ip | date | verdict

Do not modify any file outside hunt-results/.

You are a cloud threat hunter. Use the CloudTrail MCP server to find privilege escalation 
attempts in the past 14 days.

Target events:
- iam:AttachUserPolicy (especially AdministratorAccess or PowerUserAccess)
- iam:AttachRolePolicy
- iam:CreateAccessKey
- iam:PutUserPolicy (inline policies)
- iam:UpdateAssumeRolePolicy

For each hit:
1. What principal made the call?
2. What was the target principal?
3. Was this principal also seen in IAM enumeration events in the prior 24 hours?

Output: timestamp | actor | target | action | policy attached | prior enumeration?

Do not modify any file outside hunt-results/.

You are a cloud threat hunter. Use the CloudTrail MCP server to search for any CloudTrail 
configuration changes in the past 30 days.

Target events:
- cloudtrail:StopLogging
- cloudtrail:DeleteTrail
- cloudtrail:PutEventSelectors (check if management events were narrowed or excluded)
- cloudtrail:UpdateTrail

For each hit:
1. What was changed?
2. What was the before/after configuration?
3. Was logging restored within 5 minutes (possible authorized change)?

Output: timestamp | principal | action | trail ARN | change summary | logging restored?

Do not modify any file outside hunt-results/.

/goal Run all five credential-access hunt patterns (GetCallerIdentity anomalies, IAM enumeration, 
OIDC token abuse, privilege escalation, log tampering) against the past 30 days of CloudTrail data.

Success condition: All five hunts complete with findings written to hunt-results/.

If any hunt returns a HIGH or CRITICAL finding, write ESCALATE.md listing the finding, 
affected principal, and recommended action, then stop.

If all five complete with zero findings, write CLEAN.md with a timestamp and summary.

Do not modify any file outside hunt-results/.

claude --print "/goal Run all five credential-access hunt patterns..."

# Threat Hunt Context

AWS account: production
Hunt scope: credential access (T1078, T1087, T1098, T1550, T1562)
Output directory: hunt-results/
IAM profile: threat-hunt-readonly
Do not modify files outside hunt-results/.

# Run every Monday at 06:00 UTC
0 6 * * 1 cd /path/to/hunt && claude --print "/goal Run weekly credential-access hunt. Write ESCALATE.md or CLEAN.md in hunt-results/." >> hunt-results/weekly-$(date +%Y%m%d).log 2>&1