<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-forensics
description: >-
  Conduct digital forensics investigations in cloud environments including evidence
  collection, disk imaging, memory acquisition, log analysis, and chain of custody.
domain: cybersecurity
subdomain: cloud-security
tags:
  - forensics
  - incident-response
  - evidence-collection
  - disk-imaging
  - memory-acquisition
  - cloudtrail
  - chain-of-custody
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Performing Cloud Forensics

## Overview

Cloud forensics requires adapted techniques from traditional DFIR — evidence is volatile,
distributed across services, and subject to shared responsibility. This skill covers
evidence preservation workflows for AWS/Azure/GCP: disk snapshots, memory acquisition,
log collection, network traffic capture, and maintaining chain of custody in cloud-native
environments.

Mode: `[MODE: INCIDENT]` — Evidence preservation and forensic analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI, Azure CLI, or gcloud CLI with incident response permissions | Required |
| IAM permissions | EC2 snapshot creation, CloudTrail access, S3 read, VPC Flow Logs |
| Forensic analysis tools | `volatility3`, `sleuthkit`, `plaso` |
| Isolated forensics account/VPC for analysis | Required |
| Python 3.10+ with `boto3` | Required |

## Key Concepts

### Evidence Collection Priority

Collect in order of volatility (most volatile first):

1. **Running processes / memory** — Instance metadata, /proc, memory dump
2. **Network connections** — VPC Flow Logs, Security Group rules, DNS logs
3. **CloudTrail / Audit Logs** — API call history
4. **Disk snapshots** — EBS volumes, managed disks
5. **Cloud service state** — IAM, S3, Lambda configurations
6. **Billing and cost data** — Unusual resource creation

### Instance Isolation

```bash
# AWS — Create isolation security group (deny all)
ISOLATION_SG=$(aws ec2 create-security-group \
  --group-name "forensic-isolation" \
  --description "IR isolation - deny all traffic" \
  --vpc-id $VPC_ID --query GroupId --output text)

# Remove all ingress/egress rules (default egress)
aws ec2 revoke-security-group-egress --group-id $ISOLATION_SG \
  --ip-permissions '[{"IpProtocol":"-1","FromPort":-1,"ToPort":-1,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'

# Apply to compromised instance
aws ec2 modify-instance-attribute --instance-id $INSTANCE_ID --groups $ISOLATION_SG

# Disable instance termination protection
aws ec2 modify-instance-attribute --instance-id $INSTANCE_ID --disable-api-termination
```

### Disk Forensics

```bash
# AWS — Snapshot all volumes from compromised instance
VOLUMES=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
  --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' --output text)

for vol in $VOLUMES; do
  SNAP=$(aws ec2 create-snapshot --volume-id $vol \
    --description "FORENSIC-IR-$(date +%Y%m%d)-$INSTANCE_ID" \
    --tag-specifications "ResourceType=snapshot,Tags=[{Key=IR-Case,Value=$CASE_ID},{Key=Source-Instance,Value=$INSTANCE_ID}]" \
    --query SnapshotId --output text)
  echo "Snapshot $SNAP created for volume $vol"
done

# Share snapshot with forensics account
aws ec2 modify-snapshot-attribute --snapshot-id $SNAP \
  --attribute createVolumePermission --operation-type add --user-ids $FORENSICS_ACCOUNT

# Create volume from snapshot in forensics VPC
aws ec2 create-volume --snapshot-id $SNAP --availability-zone us-east-1a \
  --volume-type gp3 --tag-specifications "ResourceType=volume,Tags=[{Key=IR-Case,Value=$CASE_ID}]"
```

### Memory Acquisition

```bash
# SSM-based memory acquisition (if SSM agent running)
aws ssm send-command --instance-ids $INSTANCE_ID \
  --document-name "AWS-RunShellScript" \
  --parameters 'commands=["sudo apt-get install -y lime-forensics-dkms || sudo yum install -y lime","sudo insmod /lib/modules/$(uname -r)/extra/lime.ko path=/tmp/memory.lime format=lime","aws s3 cp /tmp/memory.lime s3://forensics-bucket/cases/$CASE_ID/memory.lime"]'

# Analyze with Volatility 3
vol3 -f memory.lime linux.pslist
vol3 -f memory.lime linux.bash
vol3 -f memory.lime linux.netscan
```

### Log Collection

```bash
# CloudTrail events for compromised principal
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=$COMPROMISED_USER \
  --start-time "$INCIDENT_START" --end-time "$INCIDENT_END" \
  --output json > /forensics/cloudtrail_$COMPROMISED_USER.json

# VPC Flow Logs for compromised instance
# (Query via Athena or CloudWatch Logs Insights)
aws logs start-query --log-group-name "vpc-flow-logs" \
  --start-time $(date -d "$INCIDENT_START" +%s) \
  --end-time $(date -d "$INCIDENT_END" +%s) \
  --query-string "fields @timestamp, srcAddr, dstAddr, dstPort, action | filter srcAddr = '$INSTANCE_IP' or dstAddr = '$INSTANCE_IP' | sort @timestamp asc"

# DNS query logs (if Route53 Resolver logging enabled)
aws logs filter-log-events --log-group-name "/aws/route53/resolver" \
  --filter-pattern "$INSTANCE_IP"
```

### Chain of Custody

```bash
# Generate SHA256 hash of evidence
sha256sum /forensics/disk.img > /forensics/disk.img.sha256
sha256sum /forensics/memory.lime > /forensics/memory.lime.sha256

# Log collection metadata
cat > /forensics/chain_of_custody.json << EOF
{
  "case_id": "$CASE_ID",
  "collected_by": "$(aws sts get-caller-identity --query Arn --output text)",
  "collection_time": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "evidence_items": [
    {"type": "disk_snapshot", "id": "$SNAP", "sha256": "$(cat /forensics/disk.img.sha256 | cut -d' ' -f1)"},
    {"type": "memory_dump", "file": "memory.lime", "sha256": "$(cat /forensics/memory.lime.sha256 | cut -d' ' -f1)"},
    {"type": "cloudtrail_logs", "file": "cloudtrail_$COMPROMISED_USER.json"}
  ]
}
EOF
```

## Workflow

### Step 1: Isolate and Preserve

```bash
node scripts/agent.js --action isolate --instance-id $INSTANCE_ID --case-id $CASE_ID
```

### Step 2: Collect Evidence

```bash
node scripts/agent.js --action collect --instance-id $INSTANCE_ID --case-id $CASE_ID --output /tmp/evidence/
```

### Step 3: Analyze

```bash
node scripts/agent.js --action analyze --evidence-dir /tmp/evidence/ --output /tmp/forensics_report.json
```

## Detection

```yaml
title: Cloud Forensics Detection
id: 520c76f6-5d57-4188-bc6d-f43f0444cadb
status: experimental
description: Detects suspicious activity related to performing cloud forensics techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Forensics Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004 |

## Verification

- [ ] Compromised instance isolated (security group applied)
- [ ] All EBS volumes snapshotted before any changes
- [ ] Memory acquired if instance still running
- [ ] CloudTrail logs collected for incident timeframe
- [ ] VPC Flow Logs collected for compromised instance
- [ ] Evidence hashes recorded for chain of custody
- [ ] Evidence stored in separate forensics account with write-once policy
- [ ] Timeline constructed from all evidence sources

## References

- [AWS Security Incident Response Guide](https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/)
- [NIST SP 800-86 — Guide to Integrating Forensic Techniques](https://csrc.nist.gov/publications/detail/sp/800-86/final)
- [MITRE ATT&CK — Cloud Matrix](https://attack.mitre.org/matrices/enterprise/cloud/)
- [Volatility 3 Documentation](https://volatility3.readthedocs.io/)
