--- namespace: aiwg name: cloud-forensics description: "AWS, Azure, and GCP forensic investigation covering audit logs, IAM review, storage access, network flows, and compute instance forensics" tools: Bash, Read, Write, Glob, Grep platforms: [all] --- # cloud-forensics Investigates cloud environments for signs of compromise, data exfiltration, privilege escalation, and persistence. Parameterized by cloud provider. Adapts collection procedures to AWS CloudTrail, Azure Monitor/Activity Log, and GCP Cloud Audit Logs. Maps findings to MITRE ATT&CK Cloud techniques. ## Triggers Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description): - "CloudTrail" → AWS audit log analysis - "Activity Log" → Azure audit log analysis - "Cloud Audit Logs" → GCP audit log analysis - "IAM review" → cloud identity forensics ## Purpose Cloud forensics requires provider-specific tooling and log sources. An AWS investigation centers on CloudTrail and GuardDuty; Azure on Activity Logs and Defender for Cloud; GCP on Cloud Audit Logs and Security Command Center. This skill selects the appropriate collection path and produces a consistent findings document regardless of provider. ## Behavior When triggered, this skill: 1. **Identify cloud provider and configure access**: - AWS: verify `aws sts get-caller-identity` — record account ID, ARN, and user ID - Azure: verify `az account show` — record subscription ID, tenant ID, and principal - GCP: verify `gcloud auth list` and `gcloud config get-value project` - Prompt for provider if not determinable from environment 2. **AWS — CloudTrail audit log collection**: - List trails: `aws cloudtrail describe-trails` - Check if logging is enabled on all trails and all regions - Pull recent management events: `aws cloudtrail lookup-events --max-results 1000` - Flag high-risk event names: `CreateUser`, `AttachUserPolicy`, `PutRolePolicy`, `AssumeRole`, `GetSecretValue`, `DeleteTrail`, `StopLogging`, `PutBucketPolicy` - Check for CloudTrail log integrity validation status 3. **AWS — IAM review**: - List all IAM users and check for access keys older than 90 days: `aws iam list-users` + `aws iam list-access-keys` - List users with `AdministratorAccess` managed policy - List roles with trust policies allowing external principals or `*` in Principal - Check for recently created or modified IAM entities (within investigation window) - Download and analyze credential report: `aws iam generate-credential-report && aws iam get-credential-report` 4. **AWS — storage and data access**: - List S3 buckets with public access settings: `aws s3api get-public-access-block --bucket ` - Check for buckets with server access logging disabled - Review recent S3 data events in CloudTrail if data event logging is enabled - Check Secrets Manager and SSM Parameter Store access events 5. **Azure — Activity Log collection**: - Pull activity log for the investigation window: `az monitor activity-log list --start-time --end-time ` - Flag high-risk operations: role assignment creation, policy assignments, key vault access, storage account key rotation, VM disk snapshots - Check Defender for Cloud alerts: `az security alert list` 6. **Azure — IAM (RBAC) review**: - List Owner and Contributor role assignments at subscription scope: `az role assignment list --include-classic-administrators` - Flag service principals with no associated application or with expired credentials - Check for recently created managed identities 7. **GCP — Cloud Audit Log collection**: - Query Admin Activity logs: `gcloud logging read 'logName:"cloudaudit.googleapis.com/activity"' --limit=1000` - Query Data Access logs if enabled - Flag: `SetIamPolicy`, `CreateServiceAccountKey`, `ActAs`, `signBlob`, bucket ACL changes - Check Security Command Center findings: `gcloud scc findings list ` 8. **GCP — IAM review**: - List project-level IAM bindings: `gcloud projects get-iam-policy ` - Flag roles/owner and roles/editor at project or folder scope - List service account keys and flag keys older than 90 days - Check for allUsers or allAuthenticatedUsers bindings on any resource 9. **Compute instance forensics (all providers)**: - List running instances with metadata (creation time, last started, associated IAM role/service account) - Flag instances with public IP addresses that have inbound rules permitting 0.0.0.0/0 on sensitive ports - Check for recently created disk snapshots (potential exfiltration staging) - Review instance serial console output or boot logs where available 10. **Network flow log review**: - AWS: pull VPC Flow Logs for unusual outbound traffic patterns from targeted instances - Azure: pull NSG Flow Logs - GCP: pull VPC Flow Logs - Flag large data transfers, connections to known-bad IPs, and unusual destination ports 11. **Write findings document**: - Save to `.aiwg/forensics/findings/cloud--forensics.md` - Sections: identity findings, logging gaps, data access anomalies, network anomalies, persistence indicators ## Usage Examples ### Example 1 — AWS ``` aws investigation ``` Uses the currently configured AWS CLI profile. ### Example 2 — GCP with project ``` gcp forensics --project my-project-id ``` ### Example 3 — Azure ``` azure forensics --subscription 00000000-0000-0000-0000-000000000000 ``` ## Output Locations - Findings: `.aiwg/forensics/findings/cloud--forensics.md` - Raw IAM report: `.aiwg/forensics/evidence/cloud--iam.json` - Audit log export: `.aiwg/forensics/evidence/cloud--audit.json` ## Configuration ```yaml cloud_forensics: investigation_window_hours: 72 high_risk_aws_events: - CreateUser - AttachUserPolicy - PutRolePolicy - DeleteTrail - StopLogging - GetSecretValue key_age_threshold_days: 90 flag_public_instances: true ``` ## References - @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/research-before-decision.md — Verify provider identity and access before collection; detect available log sources - @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/evidence-integrity.md — Export and hash cloud artifacts before analysis; record snapshot IDs in custody log - @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/red-flag-escalation.md — Escalate when CloudTrail tampering (StopLogging, DeleteTrail) or active IAM privilege escalation is found - @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/evidence-preservation/SKILL.md — Cloud evidence (snapshots, log exports) must be preserved per custody procedures - @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/ioc-extraction/SKILL.md — Extract IOCs (suspicious IPs, ARNs, service principal IDs) from cloud audit log findings