<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cloud-forensics
description: >-
  Cloud forensic acquisition and analysis across AWS, Azure, and GCP.
  Covers CloudTrail log analysis, snapshot-based disk acquisition, IAM
  activity reconstruction, container forensics, and serverless execution
  tracing using cloud-native APIs and open-source tools for incident
  response in multi-tenant environments.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - cloud-forensics
  - aws
  - azure
  - gcp
  - cloudtrail
  - s3
  - iam
  - container-forensics
  - snapshot-acquisition
  - libcloudforensics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1530", "T1537", "T1078.004"]
  nist-csf: ["RS.AN-1", "RS.AN-3", "DE.AE-3"]
  frameworks: ["NIST SP 800-86", "CSA Cloud Forensics", "MITRE ATT&CK Cloud"]
---

# Performing Cloud Forensics

## Overview

Cloud forensics adapts traditional forensic methodology to ephemeral,
multi-tenant cloud environments. Evidence acquisition requires API-based
collection rather than physical access. This skill covers log retrieval,
disk snapshot acquisition, IAM activity reconstruction, and container
forensics across AWS, Azure, and GCP.

## Prerequisites

- AWS CLI, Azure CLI, or gcloud SDK configured with investigator credentials
- `libcloudforensics`, `cloud-forensics-utils`, `jq`, `plaso`
- IAM permissions: read-only access to CloudTrail, EBS snapshots, S3
- Incident response role with cross-account assume capability

```bash
pip install libcloudforensics cloud-forensics-utils
sudo apt install jq awscli azure-cli
```

## Key Concepts

### Evidence Sources by Provider

| Source | AWS | Azure | GCP |
|--------|-----|-------|-----|
| API Audit Logs | CloudTrail | Activity Log | Cloud Audit Logs |
| Disk Snapshots | EBS Snapshots | Managed Disk Snapshots | Persistent Disk Snapshots |
| Network Logs | VPC Flow Logs | NSG Flow Logs | VPC Flow Logs |
| DNS Logs | Route53 Query Logs | DNS Analytics | Cloud DNS Logs |
| Storage Access | S3 Access Logs | Storage Analytics | GCS Access Logs |
| Auth Logs | IAM/CloudTrail | Azure AD Sign-in | IAM Audit Logs |

### Volatility Order (Cloud RFC 3227 Adaptation)

```
1. Running instance memory (if accessible)
2. Cloud API audit logs (immutable once written)
3. Network flow logs
4. Disk snapshots of running instances
5. Storage bucket contents and access logs
6. IAM configuration and policy history
7. Infrastructure-as-code state files
```

## Workflow

### Step 1: AWS CloudTrail Log Acquisition

```bash
# Download CloudTrail logs for date range
aws cloudtrail lookup-events \
  --start-time "2026-03-10T00:00:00Z" \
  --end-time "2026-03-17T23:59:59Z" \
  --max-results 1000 \
  --output json > cloudtrail_events.json

# Filter for specific IAM user activity
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
  --output json > user_activity.json

# Search for console logins
jq '.Events[] | select(.EventName == "ConsoleLogin")' cloudtrail_events.json

# Search for credential abuse
jq '.Events[] | select(.EventName | test("CreateAccessKey|AssumeRole|GetSessionToken"))' \
  cloudtrail_events.json

# S3 data access events (requires data events enabled)
jq '.Events[] | select(.EventSource == "s3.amazonaws.com")' cloudtrail_events.json
```

### Step 2: EBS Snapshot Acquisition

```bash
# Create snapshot of suspect instance volume
INSTANCE_ID="i-0abc123def456789"
VOLUME_ID=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
  --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' \
  --output text)

aws ec2 create-snapshot \
  --volume-id $VOLUME_ID \
  --description "Forensic snapshot - IR-2026-0317" \
  --tag-specifications "ResourceType=snapshot,Tags=[{Key=Forensic,Value=true}]"

# Copy snapshot to forensic account (cross-account)
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-0abc123 \
  --description "Forensic copy - IR-2026-0317"

# Create volume from snapshot in forensic VPC
aws ec2 create-volume \
  --snapshot-id snap-0forensic123 \
  --availability-zone us-east-1a \
  --volume-type gp3 \
  --tag-specifications "ResourceType=volume,Tags=[{Key=Forensic,Value=true}]"
```

### Step 3: VPC Flow Log Analysis

```bash
# Query VPC Flow Logs via CloudWatch Insights
aws logs start-query \
  --log-group-name "vpc-flow-logs" \
  --start-time $(date -d "7 days ago" +%s) \
  --end-time $(date +%s) \
  --query-string 'fields @timestamp, srcAddr, dstAddr, dstPort, action
    | filter action = "REJECT"
    | stats count(*) by srcAddr, dstPort
    | sort count desc
    | limit 50'

# Download raw flow logs from S3
aws s3 sync s3://vpc-flow-log-bucket/AWSLogs/ ./flow_logs/ \
  --include "*.log.gz"

# Parse flow logs for suspicious outbound
zcat flow_logs/*.gz | awk '$4 !~ /^10\./ && $7 > 0 {print $4, $5, $7}' \
  | sort | uniq -c | sort -rn | head -20
```

### Step 4: Azure Activity Log Collection

```bash
# Export Azure activity logs
az monitor activity-log list \
  --start-time "2026-03-10T00:00:00Z" \
  --end-time "2026-03-17T23:59:59Z" \
  --output json > azure_activity.json

# Filter for authentication events
az monitor activity-log list \
  --start-time "2026-03-10T00:00:00Z" \
  --resource-provider "Microsoft.Authorization" \
  --output json > azure_auth.json

# Azure AD sign-in logs
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=createdDateTime ge 2026-03-10" \
  --output json > azure_signins.json
```

### Step 5: Container Forensics

```bash
# Capture running container state
docker inspect <container_id> > container_metadata.json
docker logs <container_id> > container_logs.txt 2>&1
docker diff <container_id> > container_changes.txt

# Export container filesystem
docker export <container_id> -o container_fs.tar

# Kubernetes pod forensics
kubectl logs <pod_name> --all-containers --timestamps > pod_logs.txt
kubectl describe pod <pod_name> > pod_describe.txt
kubectl get events --field-selector involvedObject.name=<pod_name> > pod_events.txt

# EKS audit logs (CloudWatch)
aws logs filter-log-events \
  --log-group-name "/aws/eks/cluster/audit" \
  --filter-pattern '{ $.user.username = "system:anonymous" }'
```

## Detection

```yaml
title: Cloud Forensics Detection
id: 8967d205-0606-4f8f-9868-cfd4c3d01140
status: experimental
description: Detects suspicious activity related to performing cloud forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*cloud*"
  condition: selection
level: medium
tags:
  - attack.t1530
  - attack.t1537
  - attack.t1078.004
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Audit logs collected with complete time range coverage
- [ ] Disk snapshots created and copied to forensic account
- [ ] Network flow logs retrieved and parsed
- [ ] IAM activity timeline reconstructed
- [ ] Container state captured before termination
- [ ] All evidence tagged with case identifier
- [ ] Chain of custody documented with API call timestamps

## References

- [AWS Incident Response Guide](https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/)
- [libcloudforensics](https://github.com/google/cloud-forensics-utils)
- [CSA Cloud Forensics Capability Matrix](https://cloudsecurityalliance.org/)
- [MITRE ATT&CK Cloud Matrix](https://attack.mitre.org/matrices/enterprise/cloud/)
- [Azure IR Playbook](https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks)
