<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Cloud API Abuse — API Reference

## AWS CloudTrail

```bash
# Lookup events by attribute
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time START --max-results 50

# Lookup by username
aws cloudtrail lookup-events --lookup-attributes AttributeKey=Username,AttributeValue=USER \
  --start-time START

# Describe trails
aws cloudtrail describe-trails --query 'trailList[].{Name:Name,MultiRegion:IsMultiRegionTrail}'

# CloudTrail Insights (anomaly detection)
aws cloudtrail get-insight-selectors --trail-name TRAIL_NAME
```

## Azure Activity Logs

```bash
# Query activity log
az monitor activity-log list --start-time START --query "[?status.value=='Failed']"

# Sign-in logs via Graph
az rest --method GET --url "https://graph.microsoft.com/v1.0/auditLogs/signIns"

# Risky sign-ins
az rest --method GET --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=riskLevelDuringSignIn eq 'high'"
```

## GCP Audit Logs

```bash
# Read admin activity logs
gcloud logging read 'logName:"activity"' --limit=50 --freshness=1d

# IAM policy changes
gcloud logging read 'protoPayload.methodName="SetIamPolicy"' --limit=50

# Service account key creation
gcloud logging read 'protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"'
```

## API Abuse Indicators

| Pattern | Indicator | Severity |
|---------|-----------|----------|
| Credential stuffing | >50 AccessDenied in 1h from single IP | High |
| Reconnaissance | >100 Describe/List calls in 1h | Medium |
| Geographic impossibility | Same creds from 2+ countries in <1h | High |
| Privilege escalation | IAM policy changes after initial access | Critical |
| Key leakage | API calls from unknown user agents | Medium |

## MITRE ATT&CK Mapping

| Technique | ID | Detection |
|-----------|----|-----------|
| Valid Accounts: Cloud | T1078.004 | Unusual login patterns |
| Cloud Infrastructure Discovery | T1580 | Describe/List API bursts |
| Account Manipulation | T1098 | IAM policy modifications |
