<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-cloud-ir
description: >-
  Investigates and responds to security incidents in cloud environments (AWS, Azure,
  GCP) including compromised credentials, unauthorized resource creation, and data exfiltration.
domain: cybersecurity
subdomain: incident-response
tags:
  - cloud-security
  - AWS-IR
  - Azure-IR
  - GCP-IR
  - CloudTrail
  - IAM-compromise
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Conducting Cloud Incident Response

## Overview

Cloud IR differs fundamentally from on-premises — there are no disks to image,
no memory to dump. Instead, investigation relies on API audit logs (CloudTrail,
Azure Activity Log, GCP Audit Logs), resource metadata, and network flow logs.
Containment uses IAM policy changes rather than network isolation. The ephemeral
nature of cloud resources means evidence disappears when instances terminate.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| AWS CLI | AWS investigation | `pip install awscli` |
| Azure CLI | Azure investigation | `curl -sL https://aka.ms/InstallAzureCLIDeb \| bash` |
| gcloud CLI | GCP investigation | Google Cloud SDK |
| Prowler | Cloud security assessment | `pip install prowler` |
| ScoutSuite | Multi-cloud audit | `pip install scoutsuite` |
| CloudQuery | Cloud asset inventory | GitHub release |
| Steampipe | SQL for cloud APIs | https://steampipe.io |

## Key Concepts

### Cloud Audit Log Sources

| Cloud | Primary Log | Retention | Key Events |
|-------|------------|-----------|------------|
| AWS | CloudTrail | 90 days (free) | API calls, console logins, S3 access |
| Azure | Activity Log | 90 days | Resource operations, sign-in logs |
| GCP | Cloud Audit Logs | 400 days (Admin) | API calls, data access |

### Cloud-Specific Attack Patterns

| Pattern | TTPs | Detection |
|---------|------|-----------|
| Credential compromise | T1078 Valid Accounts | Unusual API calls, new regions |
| Crypto mining | T1496 Resource Hijacking | EC2/compute spike, new instance types |
| Data exfiltration | T1537 Transfer to Cloud Account | S3 policy changes, cross-account access |
| Privilege escalation | T1098 Account Manipulation | IAM policy modifications |
| Persistence | T1098.001 Additional Cloud Credentials | New access keys, new users |

### Evidence Preservation in Cloud

Cloud evidence is ephemeral — preserve immediately:
- Snapshot running instances before termination
- Export CloudTrail/audit logs to secure S3/storage
- Save IAM policy versions
- Document resource metadata (tags, creation dates)

## Workflow

### Step 1 — Investigate CloudTrail (AWS)

```bash
# Recent API calls by compromised user
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
  --start-time $(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ) \
  --output json > /evidence/cloudtrail-user.json

# Console logins
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --output json | jq '.Events[] | {time: .EventTime, user: .Username, ip: .CloudTrailEvent | fromjson | .sourceIPAddress}'

# IAM changes
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=iam.amazonaws.com \
  --output json > /evidence/iam-events.json

# S3 data access events (requires data events enabled)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject \
  --output json > /evidence/s3-access.json

# New resources created
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
  --output json > /evidence/new-instances.json
```

### Step 2 — Containment (AWS)

```bash
# Attach DenyAll policy to compromised user
aws iam put-user-policy --user-name compromised-user \
  --policy-name DenyAll --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*"}]
  }'

# Deactivate access keys
aws iam list-access-keys --user-name compromised-user --query 'AccessKeyMetadata[].AccessKeyId' --output text | \
  xargs -I{} aws iam update-access-key --user-name compromised-user --access-key-id {} --status Inactive

# Delete compromised access keys
aws iam delete-access-key --user-name compromised-user --access-key-id AKIA...

# Revoke active sessions (for role-based access)
aws iam put-role-policy --role-name compromised-role \
  --policy-name RevokeOldSessions --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*",
      "Condition": {"DateLessThan": {"aws:TokenIssueTime": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}}}]
  }'

# Isolate compromised EC2 instance (replace security group)
aws ec2 create-security-group --group-name forensic-isolation --description "IR isolation" --vpc-id vpc-xxx
aws ec2 modify-instance-attribute --instance-id i-xxx --groups sg-forensic-isolation
```

### Step 3 — Evidence Preservation (AWS)

```bash
# Snapshot EBS volumes before termination
aws ec2 create-snapshot --volume-id vol-xxx --description "IR evidence $(date -u +%F)"

# Export CloudTrail to secure bucket
aws s3 sync s3://cloudtrail-bucket/AWSLogs/ /evidence/cloudtrail/

# Save current IAM configuration
aws iam get-account-authorization-details > /evidence/iam-snapshot.json

# Tag evidence resources
aws ec2 create-tags --resources snap-xxx --tags Key=IRCase,Value=INC-2026-001
```

### Step 4 — Azure Investigation

```bash
# Sign-in logs for compromised user
az monitor activity-log list --caller user@domain.com --start-time 2026-03-10 --output json

# Azure AD sign-in logs
az rest --method get --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=userPrincipalName eq 'user@domain.com'"

# Resource creation events
az monitor activity-log list --resource-group $RG --start-time 2026-03-10 --output json

# Disable Azure AD user
az ad user update --id user@domain.com --account-enabled false

# Revoke sessions
az rest --method post --url "https://graph.microsoft.com/v1.0/users/$USER_ID/revokeSignInSessions"
```

### Step 5 — GCP Investigation

```bash
# Admin activity logs
gcloud logging read 'logName="projects/$PROJECT/logs/cloudaudit.googleapis.com%2Factivity"
  AND protoPayload.authenticationInfo.principalEmail="user@domain.com"' \
  --limit 100 --format json

# IAM policy changes
gcloud logging read 'resource.type="project" AND protoPayload.methodName="SetIamPolicy"' \
  --limit 50 --format json

# Disable service account
gcloud iam service-accounts disable $SA_EMAIL
```

## Detection

```yaml
title: Cloud Ir Detection
id: eb5e90b4-dd49-4f8a-ae26-7016895c2d86
status: experimental
description: Detects suspicious activity related to conducting cloud ir techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*cloud*"
  condition: selection
level: high
tags:
  - attack.t1078.004
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Audit logs exported and preserved (CloudTrail/Activity Log/Audit Logs)
- [ ] Compromised credentials deactivated (access keys, passwords, tokens)
- [ ] Active sessions revoked
- [ ] Unauthorized resources identified and terminated
- [ ] EBS/disk snapshots created for evidence
- [ ] IAM configuration snapshot saved
- [ ] Security groups updated to isolate compromised instances
- [ ] All evidence tagged with IR case identifier

## References

- AWS Security Incident Response Guide: https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide
- Azure Security Best Practices: https://learn.microsoft.com/en-us/azure/security
- GCP Incident Response: https://cloud.google.com/security/incident-response
- MITRE ATT&CK Cloud Matrix: https://attack.mitre.org/matrices/enterprise/cloud
