One account without MFA lost an AWS account in 13 minutes

A fictional 13-minute AWS compromise read through CloudTrail, GuardDuty and VPC Flow Logs, and the guardrails that stop it.