[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFPB7X1YDM4K38P8A238JD":3,"skill-same:01M6AFPB7X1YDM4K38P8A238JD":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":73,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6AFPB7X1YDM4K38P8A238JD","performing-cloud-incident-containment-procedures",null,"Execute cloud-native incident containment across AWS, Azure, and GCP using platform CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups and network ACLs, and preserve forensic evidence via snapshots. Use when responding to a cloud security incident that requires stopping lateral movement while keeping evidence intact for later investigation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"performing cloud incident containment procedures","cloud","containment","iam","incident-containment","cloud-forensics","credentials","t1490","t1078","credential-revocation","network-isolation","security","gcp","network","cloud-security","cloud security","authentication","azure","cybersecurity","policy","2026-11-10 10:12:30",false,"---\nname: performing-cloud-incident-containment-procedures\ndescription: Execute cloud-native incident containment across AWS, Azure, and GCP using platform\n  CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups\n  and network ACLs, and preserve forensic evidence via snapshots. Use when responding to a cloud\n  security incident that requires stopping lateral movement while keeping evidence intact for\n  later investigation.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- cloud-security\n- incident-containment\n- aws\n- azure\n- gcp\n- cloud-forensics\n- credential-revocation\n- network-isolation\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\n- T1021\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Restore Access\n- Password Authentication\n- Biometric Authentication\n- Strong Password Policy\n- Restore User Account Access\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Performing Cloud Incident Containment Procedures\n\n## Overview\n\nCloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud incident containment procedures\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## AWS Containment Procedures\n\n### 1. Credential Compromise Containment\n\n```bash\n# Disable compromised IAM user access keys\naws iam update-access-key --user-name compromised-user \\\n  --access-key-id AKIA... --status Inactive\n\n# List and disable all access keys for user\naws iam list-access-keys --user-name compromised-user\naws iam delete-access-key --user-name compromised-user --access-key-id AKIA...\n\n# Attach deny-all policy to compromised user\naws iam put-user-policy --user-name compromised-user \\\n  --policy-name DenyAll \\\n  --policy-document '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Effect\": \"Deny\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\"\n    }]\n  }'\n\n# Revoke all active sessions for IAM role\naws iam put-role-policy --role-name compromised-role \\\n  --policy-name RevokeOldSessions \\\n  --policy-document '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Effect\": \"Deny\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\",\n      \"Condition\": {\n        \"DateLessThan\": {\"aws:TokenIssueTime\": \"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'\"}\n      }\n    }]\n  }'\n\n# Invalidate temporary credentials by updating role trust policy\naws iam update-assume-role-policy --role-name compromised-role \\\n  --policy-document '{\"Version\":\"2012-10-17\",\"Statement\":[]}'\n```\n\n### 2. EC2 Instance Isolation\n\n```bash\n# Create quarantine security group (no inbound, no outbound)\naws ec2 create-security-group --group-name quarantine-sg \\\n  --description \"Quarantine - No traffic allowed\" --vpc-id vpc-xxxxx\n\n# Remove all rules from quarantine SG (default allows outbound)\naws ec2 revoke-security-group-egress --group-id sg-quarantine \\\n  --ip-permissions '[{\"IpProtocol\":\"-1\",\"FromPort\":-1,\"ToPort\":-1,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0\u002F0\"}]}]'\n\n# Take forensic snapshot BEFORE containment\naws ec2 create-snapshot --volume-id vol-xxxxx \\\n  --description \"Forensic snapshot - IR Case 2025-001\" \\\n  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=IR-Case,Value=2025-001}]'\n\n# Apply quarantine security group to compromised instance\naws ec2 modify-instance-attribute --instance-id i-xxxxx \\\n  --groups sg-quarantine\n\n# Tag instance as compromised\naws ec2 create-tags --resources i-xxxxx \\\n  --tags Key=IR-Status,Value=Contained Key=IR-Case,Value=2025-001\n\n# Capture memory (if SSM agent available)\naws ssm send-command --instance-ids i-xxxxx \\\n  --document-name \"AWS-RunShellScript\" \\\n  --parameters 'commands=[\"dd if=\u002Fdev\u002Fmem of=\u002Ftmp\u002Fmemory.dump bs=1M\"]'\n```\n\n### 3. S3 Bucket Containment\n\n```bash\n# Block all public access\naws s3api put-public-access-block --bucket compromised-bucket \\\n  --public-access-block-configuration \\\n  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true\n\n# Apply deny policy to bucket\naws s3api put-bucket-policy --bucket compromised-bucket \\\n  --policy '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Sid\": \"DenyAllExceptForensics\",\n      \"Effect\": \"Deny\",\n      \"NotPrincipal\": {\"AWS\": \"arn:aws:iam::ACCOUNT:role\u002FIR-Forensics\"},\n      \"Action\": \"s3:*\",\n      \"Resource\": [\"arn:aws:s3:::compromised-bucket\",\"arn:aws:s3:::compromised-bucket\u002F*\"]\n    }]\n  }'\n\n# Enable versioning to preserve evidence\naws s3api put-bucket-versioning --bucket compromised-bucket \\\n  --versioning-configuration Status=Enabled\n\n# Enable Object Lock for evidence preservation\naws s3api put-object-lock-configuration --bucket evidence-bucket \\\n  --object-lock-configuration '{\n    \"ObjectLockEnabled\": \"Enabled\",\n    \"Rule\": {\"DefaultRetention\": {\"Mode\": \"COMPLIANCE\", \"Days\": 365}}\n  }'\n```\n\n### 4. Lambda Function Containment\n\n```bash\n# Set reserved concurrency to 0 (stops all invocations)\naws lambda put-function-concurrency --function-name compromised-function \\\n  --reserved-concurrent-executions 0\n\n# Remove all event source mappings\naws lambda list-event-source-mappings --function-name compromised-function\naws lambda delete-event-source-mapping --uuid mapping-uuid\n```\n\n## Azure Containment Procedures\n\n### 1. Identity Containment\n\n```powershell\n# Revoke all user sessions\nRevoke-AzureADUserAllRefreshToken -ObjectId \"user-object-id\"\n\n# Disable user account\nSet-AzureADUser -ObjectId \"user-object-id\" -AccountEnabled $false\n\n# Reset user password\nSet-AzureADUserPassword -ObjectId \"user-object-id\" -Password (\n  ConvertTo-SecureString \"TempP@ss!\" -AsPlainText -Force\n) -ForceChangePasswordNextLogin $true\n\n# Block sign-in via Conditional Access (emergency policy)\n# Create policy blocking user from all cloud apps\n\n# Revoke Azure AD application consent\nRemove-AzureADServiceAppRoleAssignment -ObjectId \"sp-object-id\" \\\n  -AppRoleAssignmentId \"assignment-id\"\n```\n\n### 2. VM Isolation\n\n```powershell\n# Create Network Security Group with deny-all rules\n$nsg = New-AzNetworkSecurityGroup -ResourceGroupName \"rg\" -Location \"eastus\" `\n  -Name \"quarantine-nsg\" `\n  -SecurityRules @(\n    New-AzNetworkSecurityRuleConfig -Name \"DenyAllInbound\" -Protocol * `\n      -Direction Inbound -Priority 100 -SourceAddressPrefix * `\n      -SourcePortRange * -DestinationAddressPrefix * `\n      -DestinationPortRange * -Access Deny,\n    New-AzNetworkSecurityRuleConfig -Name \"DenyAllOutbound\" -Protocol * `\n      -Direction Outbound -Priority 100 -SourceAddressPrefix * `\n      -SourcePortRange * -DestinationAddressPrefix * `\n      -DestinationPortRange * -Access Deny\n  )\n\n# Take disk snapshot for forensics\n$vm = Get-AzVM -ResourceGroupName \"rg\" -Name \"compromised-vm\"\n$snapshotConfig = New-AzSnapshotConfig -SourceUri $vm.StorageProfile.OsDisk.ManagedDisk.Id `\n  -Location \"eastus\" -CreateOption Copy\nNew-AzSnapshot -ResourceGroupName \"rg\" -SnapshotName \"forensic-snap\" -Snapshot $snapshotConfig\n\n# Apply quarantine NSG to VM NIC\n$nic = Get-AzNetworkInterface -ResourceGroupName \"rg\" -Name \"compromised-nic\"\n$nic.NetworkSecurityGroup = $nsg\nSet-AzNetworkInterface -NetworkInterface $nic\n```\n\n### 3. Storage Account Containment\n\n```powershell\n# Remove network access\nUpdate-AzStorageAccountNetworkRuleSet -ResourceGroupName \"rg\" `\n  -Name \"storageaccount\" -DefaultAction Deny\n\n# Regenerate access keys\nNew-AzStorageAccountKey -ResourceGroupName \"rg\" -Name \"storageaccount\" -KeyName key1\nNew-AzStorageAccountKey -ResourceGroupName \"rg\" -Name \"storageaccount\" -KeyName key2\n\n# Revoke all SAS tokens (by rotating keys)\n# Enable immutability for evidence preservation\n```\n\n## GCP Containment Procedures\n\n### 1. IAM Containment\n\n```bash\n# Remove all IAM bindings for compromised service account\ngcloud projects get-iam-policy PROJECT_ID --format=json > policy.json\n# Edit policy.json to remove compromised account bindings\ngcloud projects set-iam-policy PROJECT_ID policy.json\n\n# Disable service account\ngcloud iam service-accounts disable SA_EMAIL\n\n# Delete service account keys\ngcloud iam service-accounts keys list --iam-account SA_EMAIL\ngcloud iam service-accounts keys delete KEY_ID --iam-account SA_EMAIL\n```\n\n### 2. Compute Instance Isolation\n\n```bash\n# Create forensic snapshot\ngcloud compute disks snapshot compromised-disk \\\n  --snapshot-names forensic-snap-$(date +%Y%m%d) \\\n  --zone us-central1-a\n\n# Apply firewall rule to deny all traffic\ngcloud compute firewall-rules create quarantine-deny-all \\\n  --network default --action DENY --rules all \\\n  --target-tags quarantine --priority 0\n\n# Tag compromised instance\ngcloud compute instances add-tags compromised-instance \\\n  --tags quarantine --zone us-central1-a\n\n# Remove external IP\ngcloud compute instances delete-access-config compromised-instance \\\n  --access-config-name \"External NAT\" --zone us-central1-a\n```\n\n## Evidence Preservation Best Practices\n\n1. **Always snapshot before containment** - Create disk\u002Fvolume snapshots before network isolation\n2. **Preserve CloudTrail\u002FActivity Logs** - Copy logs to write-protected storage\n3. **Document all actions** - Timestamp every containment step taken\n4. **Use break-glass procedures** - Pre-establish emergency access for IR team\n5. **Maintain forensic chain of custody** - Hash all evidence artifacts\n\n## MITRE ATT&CK Cloud Techniques\n\n| Technique | Containment Action |\n|-----------|-------------------|\n| T1078 - Valid Accounts | Disable accounts, revoke tokens |\n| T1530 - Data from Cloud Storage | Lock down bucket\u002Fstorage policies |\n| T1537 - Transfer to Cloud Account | Block cross-account access |\n| T1578 - Modify Cloud Compute | Isolate instances, snapshot disks |\n| T1552 - Unsecured Credentials | Rotate all access keys and secrets |\n\n## References\n\n- [Sygnia: Cloud Incident Response Best Practices](https:\u002F\u002Fwww.sygnia.co\u002Fblog\u002Fincident-response-to-cloud-security-incidents-aws-azure-and-gcp-best-practices\u002F)\n- [Unit 42: Responding to Cloud Incidents](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fresponding-to-cloud-incidents\u002F)\n- [Wiz: Cloud Incident Response Checklist](https:\u002F\u002Fwww.wiz.io\u002Facademy\u002Fincident-response-checklist)\n- [Microsoft Cloud Security Benchmark - IR](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbenchmark\u002Fazure\u002Fmcsb-incident-response)\n","# Performing Cloud Incident Containment Procedures\n\n## Overview\n\nCloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing cloud incident containment procedures\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## AWS Containment Procedures\n\n### 1. Credential Compromise Containment\n\n```bash\n# Disable compromised IAM user access keys\naws iam update-access-key --user-name compromised-user \\\n  --access-key-id AKIA... --status Inactive\n\n# List and disable all access keys for user\naws iam list-access-keys --user-name compromised-user\naws iam delete-access-key --user-name compromised-user --access-key-id AKIA...\n\n# Attach deny-all policy to compromised user\naws iam put-user-policy --user-name compromised-user \\\n  --policy-name DenyAll \\\n  --policy-document '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Effect\": \"Deny\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\"\n    }]\n  }'\n\n# Revoke all active sessions for IAM role\naws iam put-role-policy --role-name compromised-role \\\n  --policy-name RevokeOldSessions \\\n  --policy-document '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Effect\": \"Deny\",\n      \"Action\": \"*\",\n      \"Resource\": \"*\",\n      \"Condition\": {\n        \"DateLessThan\": {\"aws:TokenIssueTime\": \"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'\"}\n      }\n    }]\n  }'\n\n# Invalidate temporary credentials by updating role trust policy\naws iam update-assume-role-policy --role-name compromised-role \\\n  --policy-document '{\"Version\":\"2012-10-17\",\"Statement\":[]}'\n```\n\n### 2. EC2 Instance Isolation\n\n```bash\n# Create quarantine security group (no inbound, no outbound)\naws ec2 create-security-group --group-name quarantine-sg \\\n  --description \"Quarantine - No traffic allowed\" --vpc-id vpc-xxxxx\n\n# Remove all rules from quarantine SG (default allows outbound)\naws ec2 revoke-security-group-egress --group-id sg-quarantine \\\n  --ip-permissions '[{\"IpProtocol\":\"-1\",\"FromPort\":-1,\"ToPort\":-1,\"IpRanges\":[{\"CidrIp\":\"0.0.0.0\u002F0\"}]}]'\n\n# Take forensic snapshot BEFORE containment\naws ec2 create-snapshot --volume-id vol-xxxxx \\\n  --description \"Forensic snapshot - IR Case 2025-001\" \\\n  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=IR-Case,Value=2025-001}]'\n\n# Apply quarantine security group to compromised instance\naws ec2 modify-instance-attribute --instance-id i-xxxxx \\\n  --groups sg-quarantine\n\n# Tag instance as compromised\naws ec2 create-tags --resources i-xxxxx \\\n  --tags Key=IR-Status,Value=Contained Key=IR-Case,Value=2025-001\n\n# Capture memory (if SSM agent available)\naws ssm send-command --instance-ids i-xxxxx \\\n  --document-name \"AWS-RunShellScript\" \\\n  --parameters 'commands=[\"dd if=\u002Fdev\u002Fmem of=\u002Ftmp\u002Fmemory.dump bs=1M\"]'\n```\n\n### 3. S3 Bucket Containment\n\n```bash\n# Block all public access\naws s3api put-public-access-block --bucket compromised-bucket \\\n  --public-access-block-configuration \\\n  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true\n\n# Apply deny policy to bucket\naws s3api put-bucket-policy --bucket compromised-bucket \\\n  --policy '{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [{\n      \"Sid\": \"DenyAllExceptForensics\",\n      \"Effect\": \"Deny\",\n      \"NotPrincipal\": {\"AWS\": \"arn:aws:iam::ACCOUNT:role\u002FIR-Forensics\"},\n      \"Action\": \"s3:*\",\n      \"Resource\": [\"arn:aws:s3:::compromised-bucket\",\"arn:aws:s3:::compromised-bucket\u002F*\"]\n    }]\n  }'\n\n# Enable versioning to preserve evidence\naws s3api put-bucket-versioning --bucket compromised-bucket \\\n  --versioning-configuration Status=Enabled\n\n# Enable Object Lock for evidence preservation\naws s3api put-object-lock-configuration --bucket evidence-bucket \\\n  --object-lock-configuration '{\n    \"ObjectLockEnabled\": \"Enabled\",\n    \"Rule\": {\"DefaultRetention\": {\"Mode\": \"COMPLIANCE\", \"Days\": 365}}\n  }'\n```\n\n### 4. Lambda Function Containment\n\n```bash\n# Set reserved concurrency to 0 (stops all invocations)\naws lambda put-function-concurrency --function-name compromised-function \\\n  --reserved-concurrent-executions 0\n\n# Remove all event source mappings\naws lambda list-event-source-mappings --function-name compromised-function\naws lambda delete-event-source-mapping --uuid mapping-uuid\n```\n\n## Azure Containment Procedures\n\n### 1. Identity Containment\n\n```powershell\n# Revoke all user sessions\nRevoke-AzureADUserAllRefreshToken -ObjectId \"user-object-id\"\n\n# Disable user account\nSet-AzureADUser -ObjectId \"user-object-id\" -AccountEnabled $false\n\n# Reset user password\nSet-AzureADUserPassword -ObjectId \"user-object-id\" -Password (\n  ConvertTo-SecureString \"TempP@ss!\" -AsPlainText -Force\n) -ForceChangePasswordNextLogin $true\n\n# Block sign-in via Conditional Access (emergency policy)\n# Create policy blocking user from all cloud apps\n\n# Revoke Azure AD application consent\nRemove-AzureADServiceAppRoleAssignment -ObjectId \"sp-object-id\" \\\n  -AppRoleAssignmentId \"assignment-id\"\n```\n\n### 2. VM Isolation\n\n```powershell\n# Create Network Security Group with deny-all rules\n$nsg = New-AzNetworkSecurityGroup -ResourceGroupName \"rg\" -Location \"eastus\" `\n  -Name \"quarantine-nsg\" `\n  -SecurityRules @(\n    New-AzNetworkSecurityRuleConfig -Name \"DenyAllInbound\" -Protocol * `\n      -Direction Inbound -Priority 100 -SourceAddressPrefix * `\n      -SourcePortRange * -DestinationAddressPrefix * `\n      -DestinationPortRange * -Access Deny,\n    New-AzNetworkSecurityRuleConfig -Name \"DenyAllOutbound\" -Protocol * `\n      -Direction Outbound -Priority 100 -SourceAddressPrefix * `\n      -SourcePortRange * -DestinationAddressPrefix * `\n      -DestinationPortRange * -Access Deny\n  )\n\n# Take disk snapshot for forensics\n$vm = Get-AzVM -ResourceGroupName \"rg\" -Name \"compromised-vm\"\n$snapshotConfig = New-AzSnapshotConfig -SourceUri $vm.StorageProfile.OsDisk.ManagedDisk.Id `\n  -Location \"eastus\" -CreateOption Copy\nNew-AzSnapshot -ResourceGroupName \"rg\" -SnapshotName \"forensic-snap\" -Snapshot $snapshotConfig\n\n# Apply quarantine NSG to VM NIC\n$nic = Get-AzNetworkInterface -ResourceGroupName \"rg\" -Name \"compromised-nic\"\n$nic.NetworkSecurityGroup = $nsg\nSet-AzNetworkInterface -NetworkInterface $nic\n```\n\n### 3. Storage Account Containment\n\n```powershell\n# Remove network access\nUpdate-AzStorageAccountNetworkRuleSet -ResourceGroupName \"rg\" `\n  -Name \"storageaccount\" -DefaultAction Deny\n\n# Regenerate access keys\nNew-AzStorageAccountKey -ResourceGroupName \"rg\" -Name \"storageaccount\" -KeyName key1\nNew-AzStorageAccountKey -ResourceGroupName \"rg\" -Name \"storageaccount\" -KeyName key2\n\n# Revoke all SAS tokens (by rotating keys)\n# Enable immutability for evidence preservation\n```\n\n## GCP Containment Procedures\n\n### 1. IAM Containment\n\n```bash\n# Remove all IAM bindings for compromised service account\ngcloud projects get-iam-policy PROJECT_ID --format=json > policy.json\n# Edit policy.json to remove compromised account bindings\ngcloud projects set-iam-policy PROJECT_ID policy.json\n\n# Disable service account\ngcloud iam service-accounts disable SA_EMAIL\n\n# Delete service account keys\ngcloud iam service-accounts keys list --iam-account SA_EMAIL\ngcloud iam service-accounts keys delete KEY_ID --iam-account SA_EMAIL\n```\n\n### 2. Compute Instance Isolation\n\n```bash\n# Create forensic snapshot\ngcloud compute disks snapshot compromised-disk \\\n  --snapshot-names forensic-snap-$(date +%Y%m%d) \\\n  --zone us-central1-a\n\n# Apply firewall rule to deny all traffic\ngcloud compute firewall-rules create quarantine-deny-all \\\n  --network default --action DENY --rules all \\\n  --target-tags quarantine --priority 0\n\n# Tag compromised instance\ngcloud compute instances add-tags compromised-instance \\\n  --tags quarantine --zone us-central1-a\n\n# Remove external IP\ngcloud compute instances delete-access-config compromised-instance \\\n  --access-config-name \"External NAT\" --zone us-central1-a\n```\n\n## Evidence Preservation Best Practices\n\n1. **Always snapshot before containment** - Create disk\u002Fvolume snapshots before network isolation\n2. **Preserve CloudTrail\u002FActivity Logs** - Copy logs to write-protected storage\n3. **Document all actions** - Timestamp every containment step taken\n4. **Use break-glass procedures** - Pre-establish emergency access for IR team\n5. **Maintain forensic chain of custody** - Hash all evidence artifacts\n\n## MITRE ATT&CK Cloud Techniques\n\n| Technique | Containment Action |\n|-----------|-------------------|\n| T1078 - Valid Accounts | Disable accounts, revoke tokens |\n| T1530 - Data from Cloud Storage | Lock down bucket\u002Fstorage policies |\n| T1537 - Transfer to Cloud Account | Block cross-account access |\n| T1578 - Modify Cloud Compute | Isolate instances, snapshot disks |\n| T1552 - Unsecured Credentials | Rotate all access keys and secrets |\n\n## References\n\n- [Sygnia: Cloud Incident Response Best Practices](https:\u002F\u002Fwww.sygnia.co\u002Fblog\u002Fincident-response-to-cloud-security-incidents-aws-azure-and-gcp-best-practices\u002F)\n- [Unit 42: Responding to Cloud Incidents](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fresponding-to-cloud-incidents\u002F)\n- [Wiz: Cloud Incident Response Checklist](https:\u002F\u002Fwww.wiz.io\u002Facademy\u002Fincident-response-checklist)\n- [Microsoft Cloud Security Benchmark - IR](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbenchmark\u002Fazure\u002Fmcsb-incident-response)\n",{"name":5,"tags":44,"author":46,"domain":37,"license":15,"version":47,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54,"d3fend_techniques":60},[33,23,45,36,31,24,28,29],"aws","mahipal","1.0",[49,50,51,52],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response",[55,56,57,58,59],"T1486","T1490","T1070","T1078","T1021",[61,62,63,64,65],"Restore Access","Password Authentication","Biometric Authentication","Strong Password Policy","Restore User Account Access","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-cloud-incident-containment-procedures",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-incident-containment-procedures",{"tool":82,"command":83},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-incident-containment-procedures",{"tool":85,"command":86},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-cloud-incident-containment-procedures","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002FSKILL.md",true,[90,96,101,107,111,115,121],{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"assets\u002Ftemplate.md","ASSET","资产文件",1397,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002Fassets\u002Ftemplate.md",{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",5402,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fstandards.md",1165,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002Freferences\u002Fstandards.md",{"path":112,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fworkflows.md",2562,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002Freferences\u002Fworkflows.md",{"path":116,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":119,"sourceHtmlUrl":120},"scripts\u002Fagent.py","SCRIPT","脚本",12689,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002Fscripts\u002Fagent.py",{"path":122,"resourceType":117,"resourceTypeDesc":118,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fprocess.py",12780,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-cloud-incident-containment-procedures\u002Fscripts\u002Fprocess.py",[126,156,179,204,230,257],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":137,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[138,139,140,141,30,37,142,143,144,145,146,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[164,152,165,166,30,38,37,144,167,168,169,170,171,172,173,174,175,176,177,178],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[173,190,191,192,193,37,194,195,167,196,197,53,198,199,200,27,26,201,202,203],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[212,213,214,37,215,216,217,218,219,220,221,222,223,224,225,226,170,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[238,239,240,37,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":258,"name":259,"nameZh":6,"description":260,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":261,"categories":262,"keywords":264,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[263],{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[30,265,37,266,267,268,269,270,271,272,273,27,274,26,275,276,277,278,279,280],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]