[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFP4XX39M2EA5ACEDSTNNZ":3,"skill-same:01M6AFP4XX39M2EA5ACEDSTNNZ":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AFP4XX39M2EA5ACEDSTNNZ","performing-cloud-forensics-investigation",null,"Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud to snapshot volumes, capture instance metadata and security group configurations, and preserve cloud-native logs (CloudTrail, Activity Log, Audit Log). Use when investigating a suspected breach in AWS, Azure, or GCP, tracing unauthorized access through API logs, or analyzing a compromised VM, container, or serverless function.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-forensics-investigation\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"forensics","performing cloud forensics investigation","investigation","cloud","vm","audit","tracing","collect","logs","azure","cli","log-analysis","analyzing","digital-forensics","gcp","t1078","t1074","analysis","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-cloud-forensics-investigation\ndescription: Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud\n  to snapshot volumes, capture instance metadata and security group configurations, and preserve\n  cloud-native logs (CloudTrail, Activity Log, Audit Log). Use when investigating a suspected\n  breach in AWS, Azure, or GCP, tracing unauthorized access through API logs, or analyzing a\n  compromised VM, container, or serverless function.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- cloud-forensics\n- aws\n- azure\n- gcp\n- incident-response\n- log-analysis\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1078.004\n---\n\n# Performing Cloud Forensics Investigation\n\n## When to Use\n- When investigating a security breach in AWS, Azure, or GCP cloud environments\n- For collecting volatile and non-volatile evidence from cloud infrastructure\n- When tracing unauthorized access through cloud service API logs\n- During incident response requiring preservation of cloud-based evidence\n- For analyzing compromised virtual machines, containers, or serverless functions\n\n## Prerequisites\n- Administrative access to the cloud account under investigation\n- AWS CLI, Azure CLI, or gcloud CLI configured with appropriate permissions\n- Understanding of cloud-native logging (CloudTrail, Activity Log, Audit Log)\n- Forensic workstation with cloud SDKs installed\n- Knowledge of IAM, networking, and compute services in target cloud\n- Evidence preservation procedures for cloud environments\n\n## Workflow\n\n### Step 1: Preserve Cloud Evidence and Establish Scope\n\n```bash\n# === AWS Evidence Preservation ===\n# Snapshot compromised EC2 instance volumes\nINSTANCE_ID=\"i-0abc123def456789\"\nVOLUME_IDS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \\\n   --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' --output text)\n\nfor vol in $VOLUME_IDS; do\n   aws ec2 create-snapshot --volume-id $vol \\\n      --description \"Forensic snapshot - Case 2024-001 - $(date -u)\" \\\n      --tag-specifications \"ResourceType=snapshot,Tags=[{Key=Case,Value=2024-001},{Key=Evidence,Value=true}]\"\ndone\n\n# Capture instance metadata\naws ec2 describe-instances --instance-ids $INSTANCE_ID \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Finstance_metadata.json\n\n# Capture security group rules\naws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances \\\n   --instance-ids $INSTANCE_ID --query 'Reservations[].Instances[].SecurityGroups[].GroupId' --output text) \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fsecurity_groups.json\n\n# Capture network interfaces\naws ec2 describe-network-interfaces --filters \"Name=attachment.instance-id,Values=$INSTANCE_ID\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fnetwork_interfaces.json\n\n# Isolate the instance (replace security group with forensic isolation SG)\naws ec2 modify-instance-attribute --instance-id $INSTANCE_ID \\\n   --groups sg-forensic-isolation\n\n# === Azure Evidence Preservation ===\n# Snapshot a compromised VM disk\naz snapshot create --resource-group forensics-rg \\\n   --name \"case-2024-001-osdisk-snapshot\" \\\n   --source \"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002FRG\u002Fproviders\u002FMicrosoft.Compute\u002Fdisks\u002Fvm-osdisk\"\n\n# === GCP Evidence Preservation ===\ngcloud compute disks snapshot compromised-disk \\\n   --snapshot-names=\"case-2024-001-forensic\" \\\n   --zone=us-central1-a\n```\n\n### Step 2: Collect Cloud API and Access Logs\n\n```bash\n# === AWS CloudTrail Logs ===\n# Download CloudTrail events for the investigation period\naws cloudtrail lookup-events \\\n   --start-time \"2024-01-15T00:00:00Z\" \\\n   --end-time \"2024-01-20T23:59:59Z\" \\\n   --max-results 1000 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloudtrail_events.json\n\n# Filter for specific user activity\naws cloudtrail lookup-events \\\n   --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \\\n   --start-time \"2024-01-15T00:00:00Z\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fuser_activity.json\n\n# Download S3 access logs\naws s3 sync s3:\u002F\u002Fmy-cloudtrail-bucket\u002FAWSLogs\u002F \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloudtrail_s3\u002F\n\n# Query CloudTrail with Athena for large-scale analysis\naws athena start-query-execution \\\n   --query-string \"SELECT eventTime, eventName, userIdentity.arn, sourceIPAddress, errorCode\n                   FROM cloudtrail_logs\n                   WHERE eventTime BETWEEN '2024-01-15' AND '2024-01-20'\n                   AND sourceIPAddress NOT IN ('10.0.0.0\u002F8')\n                   ORDER BY eventTime\" \\\n   --result-configuration OutputLocation=s3:\u002F\u002Fforensics-bucket\u002Fathena-results\u002F\n\n# === AWS VPC Flow Logs ===\naws logs filter-log-events \\\n   --log-group-name \"vpc-flow-logs\" \\\n   --start-time $(date -d \"2024-01-15\" +%s000) \\\n   --end-time $(date -d \"2024-01-20\" +%s000) \\\n   --filter-pattern \"ACCEPT\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fvpc_flow_logs.json\n\n# === Azure Activity Log ===\naz monitor activity-log list \\\n   --start-time \"2024-01-15T00:00:00Z\" \\\n   --end-time \"2024-01-20T23:59:59Z\" \\\n   --output json > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fazure_activity.json\n\n# === GCP Audit Logs ===\ngcloud logging read 'logName=\"projects\u002FPROJECT_ID\u002Flogs\u002Fcloudaudit.googleapis.com%2Factivity\"\n   AND timestamp>=\"2024-01-15T00:00:00Z\"\n   AND timestamp\u003C=\"2024-01-20T23:59:59Z\"' \\\n   --format=json > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fgcp_audit.json\n```\n\n### Step 3: Analyze IAM and Access Patterns\n\n```bash\n# Analyze compromised credentials usage\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom collections import defaultdict\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloudtrail_events.json') as f:\n    data = json.load(f)\n\n# Analyze by source IP\nip_events = defaultdict(list)\nerror_events = []\ncritical_actions = []\n\nfor event in data.get('Events', []):\n    ct = json.loads(event.get('CloudTrailEvent', '{}'))\n    source_ip = ct.get('sourceIPAddress', 'Unknown')\n    event_name = ct.get('eventName', 'Unknown')\n    user_arn = ct.get('userIdentity', {}).get('arn', 'Unknown')\n    error = ct.get('errorCode')\n    timestamp = ct.get('eventTime', '')\n\n    ip_events[source_ip].append(event_name)\n\n    if error:\n        error_events.append({'time': timestamp, 'action': event_name, 'error': error, 'ip': source_ip})\n\n    # Flag critical actions\n    critical = ['CreateUser', 'CreateAccessKey', 'AttachUserPolicy', 'CreateRole',\n                'PutBucketPolicy', 'StopLogging', 'DeleteTrail', 'CreateKeyPair',\n                'RunInstances', 'AuthorizeSecurityGroupIngress']\n    if event_name in critical:\n        critical_actions.append({'time': timestamp, 'action': event_name, 'user': user_arn, 'ip': source_ip})\n\nprint(\"=== SOURCE IP ANALYSIS ===\")\nfor ip, events in sorted(ip_events.items(), key=lambda x: len(x[1]), reverse=True):\n    print(f\"  {ip}: {len(events)} events ({len(set(events))} unique actions)\")\n\nprint(f\"\\n=== ACCESS ERRORS ({len(error_events)} total) ===\")\nfor e in error_events[:10]:\n    print(f\"  [{e['time']}] {e['action']} -> {e['error']} from {e['ip']}\")\n\nprint(f\"\\n=== CRITICAL ACTIONS ({len(critical_actions)} total) ===\")\nfor a in critical_actions:\n    print(f\"  [{a['time']}] {a['action']} by {a['user']} from {a['ip']}\")\nPYEOF\n```\n\n### Step 4: Acquire and Analyze VM Disk Image\n\n```bash\n# Create a forensic analysis instance from the snapshot\nSNAPSHOT_ID=\"snap-0abc123def456789\"\n\n# Create volume from snapshot in isolated forensic VPC\nFORENSIC_VOL=$(aws ec2 create-volume --snapshot-id $SNAPSHOT_ID \\\n   --availability-zone us-east-1a \\\n   --tag-specifications \"ResourceType=volume,Tags=[{Key=Case,Value=2024-001}]\" \\\n   --query 'VolumeId' --output text)\n\n# Attach to forensic analysis instance (read-only mount)\naws ec2 attach-volume --volume-id $FORENSIC_VOL \\\n   --instance-id i-forensic-workstation \\\n   --device \u002Fdev\u002Fxvdf\n\n# On the forensic instance, mount read-only\nsudo mount -o ro \u002Fdev\u002Fxvdf1 \u002Fmnt\u002Fevidence\n\n# Perform standard disk forensics on the mounted volume\n# Extract logs, analyze file system, check for persistence\nls \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fvm_logs\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fetc\u002Fcrontab \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fpersistence\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fhome\u002F*\u002F.ssh\u002F \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fssh_keys\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fhome\u002F*\u002F.bash_history \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fbash_history\u002F\n```\n\n### Step 5: Generate Cloud Forensics Report\n\n```bash\n# Compile findings into structured report\npython3 \u003C\u003C 'PYEOF'\nreport = \"\"\"\nCLOUD FORENSICS INVESTIGATION REPORT\n======================================\nCase: 2024-001\nCloud Provider: AWS (Account: 123456789012)\nRegion: us-east-1\nInvestigation Period: 2024-01-15 to 2024-01-20\n\nEVIDENCE PRESERVED:\n- EC2 Instance Snapshot: snap-0abc123def456789 (i-0abc123def456789)\n- CloudTrail Logs: 2024-01-15 to 2024-01-20\n- VPC Flow Logs: 2024-01-15 to 2024-01-20\n- Instance Metadata: captured and hashed\n- Security Group Configuration: captured at time of isolation\n\nFINDINGS:\n1. Initial Access:\n   - Compromised IAM access key AKIA... used from IP 203.0.113.45\n   - First unauthorized API call: 2024-01-15 14:32:00 UTC\n   - IP geolocation: Foreign jurisdiction (not company IP range)\n\n2. Persistence:\n   - New IAM user 'backup-admin' created with AdministratorAccess\n   - New access key pair generated for backup-admin\n   - SSH key added to EC2 instance authorized_keys\n\n3. Lateral Movement:\n   - S3 bucket policies modified to allow public access\n   - Security group rules modified to allow SSH from 0.0.0.0\u002F0\n   - 3 additional EC2 instances launched for crypto-mining\n\n4. Data Exfiltration:\n   - S3 bucket 'company-confidential' accessed 234 times\n   - 12 GB of data downloaded via GetObject API calls\n   - Data transferred to external IP 185.x.x.x\n\n5. Anti-Forensics:\n   - CloudTrail logging disabled at 2024-01-18 03:00 UTC\n   - CloudWatch log groups deleted\n\nRECOMMENDATIONS:\n- Rotate all IAM credentials immediately\n- Enable MFA on all accounts\n- Restore CloudTrail logging\n- Review and restrict S3 bucket policies\n- Implement GuardDuty for continuous monitoring\n\"\"\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloud_forensics_report.txt', 'w') as f:\n    f.write(report)\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Cloud API logging | Service logs recording all API calls (CloudTrail, Activity Log, Audit Log) |\n| Volume snapshots | Point-in-time copies of cloud disk volumes for forensic preservation |\n| VPC Flow Logs | Network traffic metadata logs showing source, destination, and action |\n| IAM credential compromise | Unauthorized use of access keys, tokens, or assumed roles |\n| Instance metadata | EC2\u002FVM configuration data including network, storage, and security settings |\n| Shared responsibility | Cloud provider secures infrastructure; customer secures data and access |\n| Evidence volatility | Cloud resources can be terminated; evidence must be preserved quickly |\n| Multi-region artifacts | Attacks may span regions requiring cross-region log collection |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| AWS CLI | Command-line interface for AWS service interaction and log collection |\n| CloudTrail | AWS API call logging service for investigation and auditing |\n| Azure Monitor | Azure logging and diagnostics platform |\n| GCP Cloud Logging | Google Cloud audit and access logging service |\n| Athena | AWS serverless SQL query service for analyzing CloudTrail logs at scale |\n| Prowler | Open-source AWS security assessment and forensic collection tool |\n| ScoutSuite | Multi-cloud security auditing tool |\n| CADO Response | Cloud-native digital forensics and incident response platform |\n\n## Common Scenarios\n\n**Scenario 1: Compromised IAM Access Keys**\nIdentify the compromised key in CloudTrail, trace all API calls made with the key, determine the source IPs and actions taken, check for persistence mechanisms (new users, roles, keys), revoke the compromised credentials, assess data access scope.\n\n**Scenario 2: Cryptojacking on EC2 Instances**\nDetect unauthorized instance launches in CloudTrail, snapshot the mining instances for analysis, examine security group changes that allowed C2 communication, identify the initial access vector (stolen keys, SSRF), calculate resource costs incurred.\n\n**Scenario 3: S3 Data Breach**\nAnalyze S3 access logs and CloudTrail for GetObject\u002FPutBucketPolicy events, identify who modified bucket policies to allow public access, determine the scope of data exposure, check for data downloads from unauthorized IPs, assess regulatory reporting requirements.\n\n**Scenario 4: Container Escape in EKS\u002FAKS\u002FGKE**\nCollect Kubernetes audit logs and cloud provider logs, analyze pod creation events for privilege escalation attempts, examine node-level logs for container escape evidence, check for unauthorized access to cloud metadata service (169.254.169.254), trace lateral movement to cloud APIs.\n\n## Output Format\n\n```\nCloud Forensics Summary:\n  Cloud: AWS (us-east-1) Account: 123456789012\n  Investigation: 2024-01-15 to 2024-01-20\n  Incident Type: IAM Credential Compromise + Data Exfiltration\n\n  Evidence Collected:\n    EBS Snapshots:    3 volumes preserved\n    CloudTrail Events: 12,456 (1,234 from attacker IP)\n    VPC Flow Logs:    45,678 records\n    S3 Access Logs:   2,345 entries\n\n  Attack Timeline:\n    2024-01-15 14:32 - Compromised access key first used from 203.0.113.45\n    2024-01-15 14:45 - New IAM user created with admin privileges\n    2024-01-16 02:00 - S3 bucket policy modified (public access enabled)\n    2024-01-16 03:00 - 12 GB downloaded from company-confidential bucket\n    2024-01-18 03:00 - CloudTrail logging disabled\n\n  Impact Assessment:\n    Data Exposed: 12 GB from 3 S3 buckets\n    Resources Created: 3 EC2 instances (crypto mining)\n    Estimated Cost: $4,500 in unauthorized compute\n```\n","# Performing Cloud Forensics Investigation\n\n## When to Use\n- When investigating a security breach in AWS, Azure, or GCP cloud environments\n- For collecting volatile and non-volatile evidence from cloud infrastructure\n- When tracing unauthorized access through cloud service API logs\n- During incident response requiring preservation of cloud-based evidence\n- For analyzing compromised virtual machines, containers, or serverless functions\n\n## Prerequisites\n- Administrative access to the cloud account under investigation\n- AWS CLI, Azure CLI, or gcloud CLI configured with appropriate permissions\n- Understanding of cloud-native logging (CloudTrail, Activity Log, Audit Log)\n- Forensic workstation with cloud SDKs installed\n- Knowledge of IAM, networking, and compute services in target cloud\n- Evidence preservation procedures for cloud environments\n\n## Workflow\n\n### Step 1: Preserve Cloud Evidence and Establish Scope\n\n```bash\n# === AWS Evidence Preservation ===\n# Snapshot compromised EC2 instance volumes\nINSTANCE_ID=\"i-0abc123def456789\"\nVOLUME_IDS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \\\n   --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' --output text)\n\nfor vol in $VOLUME_IDS; do\n   aws ec2 create-snapshot --volume-id $vol \\\n      --description \"Forensic snapshot - Case 2024-001 - $(date -u)\" \\\n      --tag-specifications \"ResourceType=snapshot,Tags=[{Key=Case,Value=2024-001},{Key=Evidence,Value=true}]\"\ndone\n\n# Capture instance metadata\naws ec2 describe-instances --instance-ids $INSTANCE_ID \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Finstance_metadata.json\n\n# Capture security group rules\naws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances \\\n   --instance-ids $INSTANCE_ID --query 'Reservations[].Instances[].SecurityGroups[].GroupId' --output text) \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fsecurity_groups.json\n\n# Capture network interfaces\naws ec2 describe-network-interfaces --filters \"Name=attachment.instance-id,Values=$INSTANCE_ID\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fnetwork_interfaces.json\n\n# Isolate the instance (replace security group with forensic isolation SG)\naws ec2 modify-instance-attribute --instance-id $INSTANCE_ID \\\n   --groups sg-forensic-isolation\n\n# === Azure Evidence Preservation ===\n# Snapshot a compromised VM disk\naz snapshot create --resource-group forensics-rg \\\n   --name \"case-2024-001-osdisk-snapshot\" \\\n   --source \"\u002Fsubscriptions\u002FSUB_ID\u002FresourceGroups\u002FRG\u002Fproviders\u002FMicrosoft.Compute\u002Fdisks\u002Fvm-osdisk\"\n\n# === GCP Evidence Preservation ===\ngcloud compute disks snapshot compromised-disk \\\n   --snapshot-names=\"case-2024-001-forensic\" \\\n   --zone=us-central1-a\n```\n\n### Step 2: Collect Cloud API and Access Logs\n\n```bash\n# === AWS CloudTrail Logs ===\n# Download CloudTrail events for the investigation period\naws cloudtrail lookup-events \\\n   --start-time \"2024-01-15T00:00:00Z\" \\\n   --end-time \"2024-01-20T23:59:59Z\" \\\n   --max-results 1000 \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloudtrail_events.json\n\n# Filter for specific user activity\naws cloudtrail lookup-events \\\n   --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \\\n   --start-time \"2024-01-15T00:00:00Z\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fuser_activity.json\n\n# Download S3 access logs\naws s3 sync s3:\u002F\u002Fmy-cloudtrail-bucket\u002FAWSLogs\u002F \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloudtrail_s3\u002F\n\n# Query CloudTrail with Athena for large-scale analysis\naws athena start-query-execution \\\n   --query-string \"SELECT eventTime, eventName, userIdentity.arn, sourceIPAddress, errorCode\n                   FROM cloudtrail_logs\n                   WHERE eventTime BETWEEN '2024-01-15' AND '2024-01-20'\n                   AND sourceIPAddress NOT IN ('10.0.0.0\u002F8')\n                   ORDER BY eventTime\" \\\n   --result-configuration OutputLocation=s3:\u002F\u002Fforensics-bucket\u002Fathena-results\u002F\n\n# === AWS VPC Flow Logs ===\naws logs filter-log-events \\\n   --log-group-name \"vpc-flow-logs\" \\\n   --start-time $(date -d \"2024-01-15\" +%s000) \\\n   --end-time $(date -d \"2024-01-20\" +%s000) \\\n   --filter-pattern \"ACCEPT\" \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fvpc_flow_logs.json\n\n# === Azure Activity Log ===\naz monitor activity-log list \\\n   --start-time \"2024-01-15T00:00:00Z\" \\\n   --end-time \"2024-01-20T23:59:59Z\" \\\n   --output json > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fazure_activity.json\n\n# === GCP Audit Logs ===\ngcloud logging read 'logName=\"projects\u002FPROJECT_ID\u002Flogs\u002Fcloudaudit.googleapis.com%2Factivity\"\n   AND timestamp>=\"2024-01-15T00:00:00Z\"\n   AND timestamp\u003C=\"2024-01-20T23:59:59Z\"' \\\n   --format=json > \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fgcp_audit.json\n```\n\n### Step 3: Analyze IAM and Access Patterns\n\n```bash\n# Analyze compromised credentials usage\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom collections import defaultdict\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloudtrail_events.json') as f:\n    data = json.load(f)\n\n# Analyze by source IP\nip_events = defaultdict(list)\nerror_events = []\ncritical_actions = []\n\nfor event in data.get('Events', []):\n    ct = json.loads(event.get('CloudTrailEvent', '{}'))\n    source_ip = ct.get('sourceIPAddress', 'Unknown')\n    event_name = ct.get('eventName', 'Unknown')\n    user_arn = ct.get('userIdentity', {}).get('arn', 'Unknown')\n    error = ct.get('errorCode')\n    timestamp = ct.get('eventTime', '')\n\n    ip_events[source_ip].append(event_name)\n\n    if error:\n        error_events.append({'time': timestamp, 'action': event_name, 'error': error, 'ip': source_ip})\n\n    # Flag critical actions\n    critical = ['CreateUser', 'CreateAccessKey', 'AttachUserPolicy', 'CreateRole',\n                'PutBucketPolicy', 'StopLogging', 'DeleteTrail', 'CreateKeyPair',\n                'RunInstances', 'AuthorizeSecurityGroupIngress']\n    if event_name in critical:\n        critical_actions.append({'time': timestamp, 'action': event_name, 'user': user_arn, 'ip': source_ip})\n\nprint(\"=== SOURCE IP ANALYSIS ===\")\nfor ip, events in sorted(ip_events.items(), key=lambda x: len(x[1]), reverse=True):\n    print(f\"  {ip}: {len(events)} events ({len(set(events))} unique actions)\")\n\nprint(f\"\\n=== ACCESS ERRORS ({len(error_events)} total) ===\")\nfor e in error_events[:10]:\n    print(f\"  [{e['time']}] {e['action']} -> {e['error']} from {e['ip']}\")\n\nprint(f\"\\n=== CRITICAL ACTIONS ({len(critical_actions)} total) ===\")\nfor a in critical_actions:\n    print(f\"  [{a['time']}] {a['action']} by {a['user']} from {a['ip']}\")\nPYEOF\n```\n\n### Step 4: Acquire and Analyze VM Disk Image\n\n```bash\n# Create a forensic analysis instance from the snapshot\nSNAPSHOT_ID=\"snap-0abc123def456789\"\n\n# Create volume from snapshot in isolated forensic VPC\nFORENSIC_VOL=$(aws ec2 create-volume --snapshot-id $SNAPSHOT_ID \\\n   --availability-zone us-east-1a \\\n   --tag-specifications \"ResourceType=volume,Tags=[{Key=Case,Value=2024-001}]\" \\\n   --query 'VolumeId' --output text)\n\n# Attach to forensic analysis instance (read-only mount)\naws ec2 attach-volume --volume-id $FORENSIC_VOL \\\n   --instance-id i-forensic-workstation \\\n   --device \u002Fdev\u002Fxvdf\n\n# On the forensic instance, mount read-only\nsudo mount -o ro \u002Fdev\u002Fxvdf1 \u002Fmnt\u002Fevidence\n\n# Perform standard disk forensics on the mounted volume\n# Extract logs, analyze file system, check for persistence\nls \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fvm_logs\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fetc\u002Fcrontab \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fpersistence\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fhome\u002F*\u002F.ssh\u002F \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fssh_keys\u002F\ncp -r \u002Fmnt\u002Fevidence\u002Fhome\u002F*\u002F.bash_history \u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fbash_history\u002F\n```\n\n### Step 5: Generate Cloud Forensics Report\n\n```bash\n# Compile findings into structured report\npython3 \u003C\u003C 'PYEOF'\nreport = \"\"\"\nCLOUD FORENSICS INVESTIGATION REPORT\n======================================\nCase: 2024-001\nCloud Provider: AWS (Account: 123456789012)\nRegion: us-east-1\nInvestigation Period: 2024-01-15 to 2024-01-20\n\nEVIDENCE PRESERVED:\n- EC2 Instance Snapshot: snap-0abc123def456789 (i-0abc123def456789)\n- CloudTrail Logs: 2024-01-15 to 2024-01-20\n- VPC Flow Logs: 2024-01-15 to 2024-01-20\n- Instance Metadata: captured and hashed\n- Security Group Configuration: captured at time of isolation\n\nFINDINGS:\n1. Initial Access:\n   - Compromised IAM access key AKIA... used from IP 203.0.113.45\n   - First unauthorized API call: 2024-01-15 14:32:00 UTC\n   - IP geolocation: Foreign jurisdiction (not company IP range)\n\n2. Persistence:\n   - New IAM user 'backup-admin' created with AdministratorAccess\n   - New access key pair generated for backup-admin\n   - SSH key added to EC2 instance authorized_keys\n\n3. Lateral Movement:\n   - S3 bucket policies modified to allow public access\n   - Security group rules modified to allow SSH from 0.0.0.0\u002F0\n   - 3 additional EC2 instances launched for crypto-mining\n\n4. Data Exfiltration:\n   - S3 bucket 'company-confidential' accessed 234 times\n   - 12 GB of data downloaded via GetObject API calls\n   - Data transferred to external IP 185.x.x.x\n\n5. Anti-Forensics:\n   - CloudTrail logging disabled at 2024-01-18 03:00 UTC\n   - CloudWatch log groups deleted\n\nRECOMMENDATIONS:\n- Rotate all IAM credentials immediately\n- Enable MFA on all accounts\n- Restore CloudTrail logging\n- Review and restrict S3 bucket policies\n- Implement GuardDuty for continuous monitoring\n\"\"\"\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fcloud\u002Fcloud_forensics_report.txt', 'w') as f:\n    f.write(report)\nprint(report)\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Cloud API logging | Service logs recording all API calls (CloudTrail, Activity Log, Audit Log) |\n| Volume snapshots | Point-in-time copies of cloud disk volumes for forensic preservation |\n| VPC Flow Logs | Network traffic metadata logs showing source, destination, and action |\n| IAM credential compromise | Unauthorized use of access keys, tokens, or assumed roles |\n| Instance metadata | EC2\u002FVM configuration data including network, storage, and security settings |\n| Shared responsibility | Cloud provider secures infrastructure; customer secures data and access |\n| Evidence volatility | Cloud resources can be terminated; evidence must be preserved quickly |\n| Multi-region artifacts | Attacks may span regions requiring cross-region log collection |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| AWS CLI | Command-line interface for AWS service interaction and log collection |\n| CloudTrail | AWS API call logging service for investigation and auditing |\n| Azure Monitor | Azure logging and diagnostics platform |\n| GCP Cloud Logging | Google Cloud audit and access logging service |\n| Athena | AWS serverless SQL query service for analyzing CloudTrail logs at scale |\n| Prowler | Open-source AWS security assessment and forensic collection tool |\n| ScoutSuite | Multi-cloud security auditing tool |\n| CADO Response | Cloud-native digital forensics and incident response platform |\n\n## Common Scenarios\n\n**Scenario 1: Compromised IAM Access Keys**\nIdentify the compromised key in CloudTrail, trace all API calls made with the key, determine the source IPs and actions taken, check for persistence mechanisms (new users, roles, keys), revoke the compromised credentials, assess data access scope.\n\n**Scenario 2: Cryptojacking on EC2 Instances**\nDetect unauthorized instance launches in CloudTrail, snapshot the mining instances for analysis, examine security group changes that allowed C2 communication, identify the initial access vector (stolen keys, SSRF), calculate resource costs incurred.\n\n**Scenario 3: S3 Data Breach**\nAnalyze S3 access logs and CloudTrail for GetObject\u002FPutBucketPolicy events, identify who modified bucket policies to allow public access, determine the scope of data exposure, check for data downloads from unauthorized IPs, assess regulatory reporting requirements.\n\n**Scenario 4: Container Escape in EKS\u002FAKS\u002FGKE**\nCollect Kubernetes audit logs and cloud provider logs, analyze pod creation events for privilege escalation attempts, examine node-level logs for container escape evidence, check for unauthorized access to cloud metadata service (169.254.169.254), trace lateral movement to cloud APIs.\n\n## Output Format\n\n```\nCloud Forensics Summary:\n  Cloud: AWS (us-east-1) Account: 123456789012\n  Investigation: 2024-01-15 to 2024-01-20\n  Incident Type: IAM Credential Compromise + Data Exfiltration\n\n  Evidence Collected:\n    EBS Snapshots:    3 volumes preserved\n    CloudTrail Events: 12,456 (1,234 from attacker IP)\n    VPC Flow Logs:    45,678 records\n    S3 Access Logs:   2,345 entries\n\n  Attack Timeline:\n    2024-01-15 14:32 - Compromised access key first used from 203.0.113.45\n    2024-01-15 14:45 - New IAM user created with admin privileges\n    2024-01-16 02:00 - S3 bucket policy modified (public access enabled)\n    2024-01-16 03:00 - 12 GB downloaded from company-confidential bucket\n    2024-01-18 03:00 - CloudTrail logging disabled\n\n  Impact Assessment:\n    Data Exposed: 12 GB from 3 S3 buckets\n    Resources Created: 3 EC2 instances (crypto mining)\n    Estimated Cost: $4,500 in unauthorized compute\n```\n",{"name":5,"tags":57,"author":61,"domain":50,"license":15,"version":62,"nist_csf":63,"subdomain":45,"description":7,"mitre_attack":67},[32,58,59,41,46,60,43],"cloud-forensics","aws","incident-response","mahipal","1.0",[64,65,66],"RS.AN-03","DE.AE-02","RS.MA-01",[68,69,70,71,72],"T1005","T1074","T1119","T1070","T1078.004","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-cloud-forensics-investigation",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-forensics-investigation",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-forensics-investigation",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-forensics-investigation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-forensics-investigation\u002FSKILL.md",true,[97,102,108],{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-forensics-investigation\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",2483,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-forensics-investigation\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",8645,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-forensics-investigation\u002Fscripts\u002Fagent.py",[115,141,165,191,215,242],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[121],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,51,50,127,128,129,130,131,132,133,134,135,136,137,138,139,140],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[147],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[149,137,150,151,51,152,50,129,153,154,155,156,157,158,159,160,161,162,163,164],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[159,176,177,178,179,50,180,181,153,182,183,60,184,185,186,47,187,188,189,190],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,50,202,203,40,204,205,206,207,208,209,210,45,211,156,212,213,214],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":222,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[221],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[223,224,225,50,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[248],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[51,250,50,251,252,253,254,255,256,257,258,47,259,187,49,260,261,262,263,264],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]