<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-forensics-investigation
description: >-
  Cloud forensic investigation across AWS, Azure, and GCP including
  CloudTrail/Activity Log/Audit Log analysis, IAM abuse detection,
  storage bucket exfiltration analysis, VM snapshot acquisition,
  container forensics, and cloud-native evidence preservation.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - cloud-forensics
  - aws
  - azure
  - gcp
  - cloudtrail
  - iam-abuse
  - container-forensics
  - evidence-preservation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1078.004", "T1530", "T1537"]
  nist-csf: ["RS.AN-3"]
  frameworks: ["NIST SP 800-86", "CSA Cloud Forensics Capability Matrix"]
---

# Performing Cloud Forensics Investigation

## Overview

Cloud forensics adapts traditional forensic techniques to cloud environments
where direct hardware access is unavailable. This skill covers log acquisition
from major cloud providers, IAM abuse detection, storage exfiltration analysis,
VM disk snapshot acquisition, container forensics, and evidence preservation
following the shared responsibility model.

## Prerequisites

- AWS CLI configured with read-only investigator role
- Azure CLI (`az`) with Reader + Log Analytics access
- GCP CLI (`gcloud`) with Viewer + Logs access
- Python 3.10+ with `boto3`, `azure-identity`, `google-cloud-logging`
- `jq` for JSON processing

```bash
pip install boto3 azure-identity azure-mgmt-compute google-cloud-logging
```

## Key Concepts

### Cloud Log Sources

| Provider | Service | Log Type | Retention |
|----------|---------|----------|-----------|
| AWS | CloudTrail | API calls, management events | 90 days (default) |
| AWS | GuardDuty | Threat detection findings | 90 days |
| AWS | VPC Flow Logs | Network flows | Configurable |
| Azure | Activity Log | Management plane operations | 90 days |
| Azure | Sign-in Logs | Authentication events | 30 days |
| Azure | NSG Flow Logs | Network flows | Configurable |
| GCP | Cloud Audit Logs | Admin & data access | 400 days (admin) |
| GCP | VPC Flow Logs | Network flows | 30 days |

### Shared Responsibility for Forensics

```
Provider manages (you can't image):
├── Physical infrastructure
├── Hypervisor layer
├── Network backbone
└── Provider service internals

You manage (you can acquire):
├── VM disk snapshots → forensic images
├── Container images and runtime data
├── Application logs
├── IAM configuration and audit logs
├── Storage bucket contents
└── Network flow logs
```

## Workflow

### Step 1: AWS CloudTrail Analysis

```bash
# Download CloudTrail logs for time window
aws cloudtrail lookup-events \
  --start-time "2026-03-15T00:00:00Z" \
  --end-time "2026-03-17T23:59:59Z" \
  --max-results 1000 \
  --output json > cloudtrail_events.json

# Search for specific API calls
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --output json

# Critical events to investigate:
# ConsoleLogin — Console access (check sourceIPAddress, MFA)
# CreateUser / CreateAccessKey — IAM persistence
# PutBucketPolicy — S3 bucket policy changes
# StopLogging — CloudTrail disabled (anti-forensics!)
# RunInstances — New EC2 instances (cryptomining?)
# AuthorizeSecurityGroupIngress — Firewall opened

# Filter with jq
cat cloudtrail_events.json | jq '.Events[] | select(.EventName == "ConsoleLogin") | {time: .EventTime, user: .Username, ip: .Resources[0].ResourceName}'
```

### Step 2: AWS EC2 Disk Acquisition

```bash
# Create snapshot of suspect EC2 volume
aws ec2 create-snapshot \
  --volume-id vol-0123456789abcdef0 \
  --description "Forensic snapshot - IR-2026-0317" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Case,Value=IR-2026-0317}]'

# Share snapshot with forensic account
aws ec2 modify-snapshot-attribute \
  --snapshot-id snap-0123456789abcdef0 \
  --attribute createVolumePermission \
  --operation-type add \
  --user-ids 123456789012

# In forensic account: create volume and attach for analysis
aws ec2 create-volume \
  --snapshot-id snap-0123456789abcdef0 \
  --availability-zone us-east-1a \
  --volume-type gp3

# Attach to forensic workstation EC2 instance
aws ec2 attach-volume \
  --volume-id vol-forensic123 \
  --instance-id i-forensicworkstation \
  --device /dev/sdf
```

### Step 3: Azure Investigation

```bash
# Query Azure Activity Log
az monitor activity-log list \
  --start-time "2026-03-15" \
  --end-time "2026-03-17" \
  --output json > azure_activity.json

# Sign-in logs (requires Azure AD P1+)
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=createdDateTime ge 2026-03-15"

# VM disk snapshot
az snapshot create \
  --name forensic-snap-001 \
  --resource-group forensics-rg \
  --source /subscriptions/.../disks/suspect-disk \
  --tags Case=IR-2026-0317
```

### Step 4: GCP Investigation

```bash
# Query Admin Activity audit logs
gcloud logging read \
  'logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity"
   AND timestamp>="2026-03-15T00:00:00Z"' \
  --format=json > gcp_audit.json

# Create disk snapshot
gcloud compute disks snapshot suspect-disk \
  --zone us-central1-a \
  --snapshot-names forensic-snap-001

# Export snapshot to Cloud Storage (for analysis)
gcloud compute images create forensic-image-001 \
  --source-snapshot forensic-snap-001
gcloud compute images export \
  --image forensic-image-001 \
  --destination-uri gs://forensics-bucket/forensic-image-001.tar.gz
```

### Step 5: Container Forensics

```bash
# Docker — capture running container state
docker export <container_id> > container_fs.tar
docker logs <container_id> > container_logs.txt 2>&1
docker inspect <container_id> > container_metadata.json
docker diff <container_id> > container_changes.txt

# Kubernetes — pod forensics
kubectl logs <pod_name> --all-containers > pod_logs.txt
kubectl describe pod <pod_name> > pod_metadata.txt
kubectl cp <pod_name>:/var/log/ ./pod_var_log/

# Snapshot pod filesystem (ephemeral container)
kubectl debug <pod_name> -it --image=busybox --target=<container> -- sh
```

## Detection

```yaml
title: Cloud Forensics Investigation Detection
id: 4104879c-7a4d-4aa6-a688-ba88cb2b06d8
status: experimental
description: Detects suspicious activity related to performing cloud forensics investigation techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*cloud*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.t1530
  - attack.t1537
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Cloud audit logs acquired for investigation time window
- [ ] IAM events analyzed for unauthorized access and persistence
- [ ] VM disk snapshots created with chain of custody tags
- [ ] Storage access logs reviewed for data exfiltration
- [ ] Network flow logs analyzed for lateral movement
- [ ] Container state preserved before termination
- [ ] Evidence integrity documented (snapshot IDs, timestamps, hashes)

## References

- [AWS CloudTrail Documentation](https://docs.aws.amazon.com/cloudtrail/)
- [Azure Activity Log](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log)
- [GCP Cloud Audit Logs](https://cloud.google.com/logging/docs/audit)
- [MITRE T1078.004 — Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
- [CSA Cloud Forensics](https://cloudsecurityalliance.org/)
