Forensics in the Cloud

Reconstructing Attacks Across AWS, Azure, GCP, and Oracle Cloud

Introduction: The New Crime Scene

1. The 3:00 AM Alert: A Realistic Cloud Incident
2. Why Cloud Forensics Is Not Just Server Forensics in a Data Center
3. What You Will Learn and How to Use This Book
4. A Note on Scope, Ethics, and the Defensive Posture

Chapter 1: Foundations of Cloud Forensics

1. The Shared Responsibility Model as a Forensic Boundary
2. Ephemeral Infrastructure and the Race Against Time
3. Cloud Forensic Artifacts: Classification and Priority
4. Legal, Compliance, and Chain-of-Custody Considerations
5. The Three Laws of Cloud Evidence Collection

Chapter 2: Cloud Architecture and Forensic Visibility

1. Public Cloud Tenancy Models and What You Can See
2. Compute, Network, Storage, and Database Layers: Visibility Spectrum
3. Managed Services and the Forensic Black Box Problem
4. Architecting for Forensics: Logging, Monitoring, and Evidence Preservation by Design
5. Regional Boundaries, Cross-Account Access, and Evidence Scoping

Chapter 3: Identity and Access Management as the Forensic Center

1. IAM Fundamentals: Users, Roles, Groups, and Policies
2. Mapping Identity Across AWS IAM, Azure AD/Entra ID, GCP IAM, and OCI IAM
3. Authentication Events: Sign-Ins, MFA, and Anomalous Patterns
4. Authorization Decisions: Why Did This User or Service Have Access?
5. Cross-Account, Cross-Tenant, and Federated Identity Forensics
6. Code Example: Parsing and Analyzing IAM Activity Logs

Chapter 4: Cloud Audit and Activity Logs

1. AWS CloudTrail: Logs, Insights, and Data Events
2. Azure Activity Logs and Diagnostic Settings
3. Google Cloud Audit Logs and Organization Policy
4. OCI Audit Service and Events
5. Cross-Provider Comparison: What Each Logs and What It Misses
6. Code Example: Building a Unified Audit Log Search Tool

Chapter 5: Authentication and Sign-In Forensics

1. Sign-In Events: What to Look for in Authentication Logs
2. Impossible Travel, Geolocation Anomalies, and Velocity Analysis
3. Token Theft, Session Hijacking, and Replay Attacks
4. Key-Based Authentication and Access Key Forensics
5. MFA Bypass, Prompt Fatigue, and Consent Attacks
6. Code Example: Detecting Suspicious Sign-In Patterns Across Providers

Chapter 6: Compute Instance Forensics

1. Instance Metadata and the Initial Reconnaissance Trail
2. Snapshot Forensics: Capturing Disks Before and During Incidents
3. Memory Acquisition in the Cloud: Tools, Timing, and Limitations
4. Process and Command-Line Artifacts
5. Instance Creation and Configuration as Evidence
6. Code Example: Automated Instance Evidence Collection Script

Chapter 7: Container and Kubernetes Forensics

1. Container Lifecycle and Forensic Implications
2. Image Layer Forensics and Registry Investigation
3. Runtime Forensics: Processes, Networks, and Volumes in Containers
4. Kubernetes API Server Logs and Audit Trail
5. EKS, AKS, GKE, and OKE: Managed Kubernetes Forensic Differences
6. Code Example: Container and Kubernetes Forensic Analysis Tool

Chapter 8: Serverless Forensics

1. Serverless Architecture and Where Evidence Lives
2. AWS Lambda Forensics: Execution Logs and Invocation Patterns
3. Azure Functions and GCP Cloud Functions Investigation
4. Code Injection and Function Misconfiguration as Attack Vectors
5. Timing Attacks, Trigger Manipulation, and Cold-Start Forensics
6. Code Example: Serverless Function Log Analysis Pipeline

Chapter 9: Network Forensics and Telemetry

1. Cloud Network Models: VPC, VNet, VPC, and Virtual Cloud Network
2. Flow Logs: AWS VPC Flow Logs, Azure NSG Flow Logs, GCP Flow Logs, OCI Flow Logs
3. DNS Query Logs and Resolution Forensics
4. Load Balancer, CDN, and Gateway Logs
5. Network-Level Indicators: Port Scanning, Beaconing, and Data Egress
6. Code Example: Network Flow Log Analysis and Visualization

Chapter 10: Storage and Data Access Forensics

1. Object Storage Forensics: S3, Blob Storage, Cloud Storage, and Object Storage
2. Access Patterns, Policy Changes, and Public Exposure Events
3. Database Forensics: RDS, Azure SQL, Cloud SQL, and Autonomous Database
4. Key Management Service Forensics: KMS, Azure Key Vault, Cloud KMS, OCI Vault
5. Detecting Data Exfiltration: Volume, Timing, and Destination Analysis
6. Code Example: Storage Access Log Analysis for Data Loss Indicators

Chapter 11: Configuration Change and Infrastructure Forensics

1. Infrastructure as Code and Change Management as Evidence
2. Security Group, Network Security List, and Firewall Rule Modifications
3. New IAM Roles, Users, and Permission Escalation Events
4. Unusual Resource Creation: Instances, Buckets, and Functions
5. Detecting and Tracking Configuration Drift
6. Code Example: Infrastructure Change Detection and Alerting

Chapter 12: Persistence and Defense Evasion in the Cloud

1. Cloud-Specific Persistence Mechanisms
2. Log Tampering, Deletion, and Suppression
3. Cloud API Proxying and C2 Infrastructure
4. Compromised CI/CD Pipelines and Supply Chain Attacks
5. Resource Misuse: Cryptominers, Botnets, and Spam Infrastructure
6. Code Example: Persistence and Defense Evasion Detection Script

Chapter 13: Compromised Credentials and Privilege Escalation

1. Credential Acquisition: Phishing, Key Exposure, and Metadata Service Abuse
2. Analyzing Compromised Access Key Usage Patterns
3. Role Assumption and Privilege Escalation Paths
4. Policy Misconfigurations That Enable Escalation
5. Containment Strategies and Impact Assessment
6. Code Example: Credential Abuse and Privilege Escalation Analysis

Chapter 14: Incident Scenarios: Walkthrough Investigations

1. Scenario 1: Compromised Developer Credentials on AWS
2. Scenario 2: Lateral Movement via Azure Role Elevation
3. Scenario 3: Data Exfiltration from GCP Cloud Storage
4. Scenario 4: Multi-Cloud Persistence and Command-and-Control
5. Scenario 5: Supply Chain Attack via CI/CD Pipeline Compromise

Chapter 15: Evidence Preservation and Chain of Custody

1. Preservation Principles: Integrity, Authenticity, and Reproducibility
2. Snapshotting, Exporting, and Archiving Evidence
3. Hashing and Verification in Cloud Environments
4. Chain of Custody: Documentation, Access Controls, and Legal Requirements
5. Working with Providers: Preservation Requests and Legal Holds
6. Code Example: Evidence Preservation and Verification Toolkit

Chapter 16: Multi-Cloud and Cross-Provider Forensics

1. Multi-Cloud Architecture and Attack Surface Considerations
2. Unified Log Aggregation and Cross-Provider Correlation
3. Federated Identity and Cross-Cloud Access Patterns
4. Data Replication, Synchronization, and Evidence Fragmentation
5. Building a Multi-Cloud Investigation Playbook
6. Code Example: Multi-Cloud Log Correlation Engine

Chapter 17: Automation, Tooling, and Building a Cloud Forensics Platform

1. Forensics Automation Philosophy: When to Automate and What to Trust
2. Building a Centralized Log Lake for Forensic Investigations
3. SIEM Integration: Splunk, Sentinel, Chronicle, and Open-Source Alternatives
4. Scripting Evidence Collection: Python, Bash, and Provider CLIs
5. Building Custom Detection Rules and Alerting Pipelines
6. Code Example: Complete Cloud Forensics Automation Framework

Chapter 18: Advanced Topics and Future Directions

1. Confidential Computing and Forensic Limitations
2. AI and Machine Learning in Cloud Incident Investigation
3. Adversarial Adaptation: Attackers Evolving Around Cloud Defenses
4. Regulatory Changes, Cross-Border Evidence, and Compliance
5. Where Cloud Forensics Is Headed: Trends and Recommendations

Conclusion: Preparing for the Next Incident

1. The Forensic Readiness Checklist
2. Building Organizational Muscle Memory
3. Key Takeaways and Recommended Next Steps

References