performing-cloud-forensics-investigation

name	performing-cloud-forensics-investigation
description	Conduct forensic investigations in cloud environments by collecting and analyzing logs, snapshots, and metadata from AWS, Azure, and GCP services. Use when conducting forensic investigations in cloud environments by collecting and analyzing.
domain	cybersecurity
tags	["forensics","cloud-forensics","aws","azure","gcp","incident-response","log-analysis"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Performing Cloud Forensics Investigation

Overview

Cybersecurity skill for performing cloud forensics investigation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing cloud forensics investigation"

• "Conduct forensic investigations in cloud environments by collecting and analyzin"

• When investigating a security breach in AWS, Azure, or GCP cloud environments

• For collecting volatile and non-volatile evidence from cloud infrastructure

• When tracing unauthorized access through cloud service API logs

• During incident response requiring preservation of cloud-based evidence

• For analyzing compromised virtual machines, containers, or serverless functions

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Administrative access to the cloud account under investigation
• AWS CLI, Azure CLI, or gcloud CLI configured with appropriate permissions
• Understanding of cloud-native logging (CloudTrail, Activity Log, Audit Log)
• Forensic workstation with cloud SDKs installed
• Knowledge of IAM, networking, and compute services in target cloud
• Evidence preservation procedures for cloud environments

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}