Enterprise Cloud Forensics and Incident Response

The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner’s ability to put their hands directly on the systems. Many examiners are trying to force old methods for on-premise examination onto cloud hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources. Enterprise Cloud Forensics and Incident Response addresses today’s need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.

Course Key Learnings:

• Understand forensic data only available in the cloud
• Implement best practices in cloud logging for DFIR
• Learn how to leverage Microsoft Azure, AWS and Google Cloud Platform resources to gather evidence
• Understand what logs Microsoft 365 and Google Workspace have available for analysts to review
• Learn how to move your forensic processes to the cloud for faster data processing

Course Content:

Module1:Microsoft 365 and Graph API

Overview

There is a universe of data out there to be discovered.

Before you can begin exploring the universe of cloud data you must learn where and how it exists. In this section, you will learn about common cloud concepts such as snapshots and cloud flows. You will understand what kind of logging and data access is provided by each cloud architecture and how to extract and process this data.

We will introduce SOF-ELK, an open-source log analysis platform that easily extends into cloud forensics. We will discuss the Microsoft 365 unified audit log (UAL) and explore two common scenarios: suspicious emails and ransomware/extortion.

We finish the day by exploring the Microsoft Graph API and review the logs that it generates.

Exercises

LAB 1.1: Visualize data in SOF-ELK

In this lab students will learn how to search and visualize data in Kibana. They will also learn how to create their own dashboard. Kibana dashboards allow analysts to display summarized statistics and predefined filters for specific scenarios.

LAB 1.2: Suspicious Email

Students will review the Unified Audit Log in SOF-ELK to find the source of a business email compromise.

LAB 1.3: Extortion

In this lab, we will examine the various SharePoint and OneDrive file operations that are typically encountered during ransomware/extortion situations.

LAB 1.4: Privilege Escalation with Graph API

The Graph API is a powerful way to interact with the Microsoft cloud (both Microsoft 365 and Azure). Understanding the permissions granted to a Graph API application is critical to eliminating blind spots and solving incidents. We will explore the logs generated by the Graph API and touch on the lack of logs under certain circumstances.

Topics

MODULE 1.1: Introducing SOF-ELK

• SOF-ELK architecture
• Logstash
• Search process
• Filtering in Kibana
  • Discover
  • Visualize Library
  • Dashboards

MODULE 1.2: Key Elements of Cloud for DFIR

• Cloud Models
• DFIR in the cloud
• Common cloud concepts
  • Shared responsibility model
  • Key logs for investigations
  • Cloud access options
  • VM disk snapshots
  • Cloud flows
  • Pricing
  • Terminology across clouds

MODULE 1.3: Microsoft 365 Unified Audit Log

• Unified Audit Log
• UAL Records
• Searching the UAL
  • Purview Portal
  • PowerShell Cmdlet
  • Microsoft 365 Management API
• Exchange Workload
• SharePoint Workload
• Azure Active Directory

MODULE 1.4: Microsoft Graph API

• Case study: SolarWinds
• Microsoft Graph API Process
• Graph API Process
• Five steps to Graph API
• Examples logs
  • Read emails
  • Create a user
• Microsoft Graph PowerShell
• Investigate your Environment

Module2: Microsoft Azure

Overview

One of the most popular cloud providers for large enterprises is the Microsoft Azure cloud. Azure offers an impressive array of services and with that comes numerous data sources for us to explore. In this section we will learn about the various Azure activity and diagnostics logs. Finally, we will find out how to deploy our own analysis tools in the cloud.

Exercises

LAB 2.1: Using SOF-ELK with Azure Logs

In this lab students will explore the azure index and discover the users and machines of pymtechlabs.com.

LAB 2.2: AAD Password Spray

In this lab students will gain experience with the Azure Active Directory logs and identify a password spray attack.

LAB 2.3: Tracking Resource Creations

In this lab students will see an example of virtual machines being created for the purpose of crypto mining.

LAB 2.4: Detecting Data Exfiltration

In this lab students will track data exfiltration through NSG flow logs and storage logs.

Topics

MODULE 2.1: Understanding Azure

• Tenant & Subscriptions
• Azure Resource Manager
• Resource groups
• Key Resources for DFIR
• Azure Resource ID Strings
• Role Based Access Control
• Accessing Microsoft Azure
  • Portal
  • CLI
  • PowerShell

• DFIR evidence in Cloud Shell

MODULE 2.2: VMs, Networking, and Storage

• Azure compute
• Virtual machine types
• Managed disk
• Azure virtual network
• Network security group
• Storage account

MODULE 2.3: Log sources for IR

• Sources of logs
• Log Analytics workspace
• Tenant logs
  • Sign-in logs
  • Successful and failed login examples
  • Audit log
  • Log analytics queries
  • Case study: Impossible logins
  • Azure Storage Explorer
  • Export to JSON
  • Import into SOF-ELK
  • Event Hubs
  • Graph API
• Subscription logs
  • Log schema
  • Viewing the activity log in the portal
  • Log analytics examples
  • Storage account and event hubs
  • Import into SOF-ELK
• Resource logs
  • NSG Flow Log
  • Import into SOF-ELK
  • Storage account logs
  • Data exfiltration

MODULE 2.4: Virtual Machine Logs

• Windows Agents
• Windows Azure Diagnostics (WAD)
• WAD Event Log Table
• Importing into SOF-ELK
• Azure VM Run Command
  • Forensic Artifacts on Target System
  • Forensic Artifacts on Source System
• Linux Logs
• VM Insights

Module2.5: In-cloud IR

• Imaging a drive in the cloud
• In-Cloud investigations
  • Snapshot Creation
  • Downloading Snapshots
  • Create a forensic VM
  • Run forensic tools
• Forensic VM Image Creation
• Other Azure resources
  • Azure Sentinel
  • Microsoft incident response playbooks
  • Azure Threat Research Matrix

Module3: Amazon (AWS)

Overview

Now that we understand what’s possible in the Cloud and the new DFIR evidence sources that exist for us, it’s time to turn to the market leader in Cloud services. In this section we will explore how AWS can be used for the responder, how to deploy your own analysis system into your region, the new and relevant log sources for your investigation and how to bring it all together in lab scenarios designed to help you quickly solve the most common AWS cases.

Exercises

LAB 3.1: Reviewing CloudTrail Logs

In this lab students will make use of exported logs from CloudTrail to identify possible account takeovers. Reviewing multiple scenarios of console access and API key access, students will learn how to find and track these attacks.

LAB 3.2: Finding Rogue VMs

In this lab students will make use of exported CloudTrail logs to locate newly created EC2 instances of different types created by attackers.

LAB 3.3: VPC Flow Logs and Route 53 Logs

In this lab students will use VPC Flow logs to find evidence of large data exfiltration. As a bonus, students can also attempt to find beacon traffic to define the indicators of compromise.

LAB 3.4: S3 Analysis

In this lab students will make use of S3 Access logs to find evidence of data exfiltration from S3 buckets.

LAB 3.5: Tracking Lateral Movement

In this lab students will use multiple log sources in order to follow an incident from initial IAM exposure to data access.

Topics

MODULE 3.1: Understanding IR in AWS

• Organizations
• IAM
• IAM Methods of Access
• CloudTrail
• CloudTrail Insights
• CloudTrail pricing
• Threat Hunting in CloudTrail
• GuardDuty

MODULE 3.2: Networking, VMs, and Storage

• Virtual Compute
  • EC2 types
  • EC2 CloudTrail logs
  • EBS types
  • EBS CloudTrail Logs
  • Snapshots
  • Snapshot CloudTrail Logs
  • EFS
  • EFS CloudTrial Logs
• Virtual Networks
  • VPCs
  • Subnets
  • VPC Flow Logs
  • Route 53
• S3 Buckets
  • S3 Buckets
  • S3 Buckets for Log Storage
  • S3 Buckets Access Policies
  • S3 Access Logs
  • S3 Transfer Acceleration

MODULE 3.3: Log sources for IR

• AWS Log Sources
• AWS Glue
• AWS Athena
• AWS Detective

MODULE 3.4: Event Drive Response

• Lambda
• Lambda Examples
• Step Functions
• Event Triggers
• Event Driven DFIR Automation

MODULE 3.5: In-cloud IR

• Creating IR VMs
• In-Cloud vs. On-Prem
• AWS systems manager
• Capturing Linux Memory
• Capturing Windows Memory

Module4: Google Workspace

Overview

This section will start with a high-level overview of Kubernetes and the logs available in each of the cloud providers.

As one of the first SaaS solutions for organizations dating back to 2006, Google Workspace has a wide array of evidence artifacts for investigators to use when conducting incident response or internal investigations. Knowing the various locations to extract evidence, and how that evidence differs depending on where it’s extracted, form one of the key concepts for Google Workspace investigations. Students will see four of the most common attacks in Google Workspace and how to investigate those attacks in depth.

As with all the cloud platforms, students will see the limitations of preserved evidence and how to extend the lifetime of evidence in Google Workspace. Students will get hands-on access to evidence and be taught skills for how to best analyze Google Workspace evidence.

Exercises

LAB 4.1: Kubernetes Log Analysis

In this lab, students will explore Kubernetes logs to identify pods within a Kubernetes cluster. Students will also search these logs for potential threat actor activity.

LAB 4.2: Google Workspace Admin BEC

In this lab, students will analyze exported Google Workspace audit and email logs to investigate an admin account compromise and determine post-compromise activities.

LAB 4.3: OAuth Abuse with Third-Party Apps

In this lab, students will investigate a suspicious OAuth application and the actions performed using its granted permissions.

LAB 4.4: Google Workspace Data Exposure

In this lab, students will review exported Google Drive audit logs to identify permissions issues and suspicious activity related to corporate files and folders.

LAB 4.5: Collecting Workspace Logs in GCP via CLI

This lab is a live walkthrough for accessing the Google Cloud Platform to extract logs from Google Workspace. It involves directly collecting evidence across the internet ready for an investigator to analyze.

Topics

MODULE 4.1: Kubernetes Forensics and IR

• Kubernetes Architecture Overview
• Logs from Kubernetes
• Attacks on Kubernetes
• Sidecar Containers and Pods

MODULE 4.2: Understanding Google Workspace

• Google’s Footprint and Shared Responsibility
• The History of Google Workspace
• Google Workspace Services
• Workspace Editions, Permissions, and Structure
• Google Workspace Groups and Permissions

MODULE 4.3: Google Workspace Evidence

• Workspace Admin Logs and SDK
• Collecting Logs from Workspace
• Workspace Admin Audit Logs
• Sending Workspace Logs to GCP
• Setting up Access for API Log Collection
• Collecting Logs via API

MODULE 4.4: ATT&CKing Workspace

• Attacks against Google Workspace
• Workspace Detections & Automated Alerts
• Email Compromise Investigation
  • Email Log Analysis
  • Google Vault Analysis
  • Advanced Phishing & Malware
• Super Admin Takeover Investigations
  • Workspace Audit Log Rules and Retention
  • Login and User Audit Log Analysis
• Third-Party App Abuse Investigations
  • What is OAuth
  • OAuth Abuse with Third-Party App
  • Workspace Token Logging and Containment
• Data Exposure / Leakage / Exfil Investigations
  • Google Drive Investigation Tools
  • Drive File Recovery
  • Drive Audit and API Logging
  • Takeout Data Exfil
  • Takeout Audit and API Logging
  • Customer Takeout Exfil

Module5: Google Cloud

Overview

Google Cloud offers many services and fundamentally changes how identity access management is treated compared to AWS and Azure, along with building in a lot of security and evidence items that are extremely useful to an incident response team. Using a combination of the GCP platform, its built-in auditing, agent-based logging, and external log analysis tools like ELK. This section will teach DFIR professionals with limited knowledge of GCP how to conduct investigations into common attacks on GCP.

Exercises

LAB 5.1: Google Cloud IAM and Access Tracking

Using the GCP Audit Logs, students will learn to profile, analyze, and summarize login sources with Kibana and GCP logs.

LAB 5.2: Collecting Logs in Google Cloud via CLI

Experience using command-line tools to directly access logs in the cloud.

LAB 5.3: Google VM Logs and Ops Agent Log Analysis

Students will learn about the logs produced by GCP’s Agent Logs and how to use them for analyzing a compromised system VM within GCP.

LAB 5.4: Storage Abuse and Exfil

Students will learn about the type of logs available to track GCP Storage Bucket exfiltration, along with additional techniques to track exfiltration when additional auditing logs are not enabled.

LAB 5.5: Google Cloud: Network Forensics

Students will learn about the networking logs and data available with GCP and how to use this evidence to conduct Network Forensics for a GCP environment.

Topics

MODULE 5.1: Understanding Google Cloud

• Organizations
• GCP Resources
• GCP identity and access management (IAM)
• Challenges with IAM
• Policy Analyzer
• Org Policies

MODULE 5.2: Log Sources, Collection & Log Routing

• Google Cloud Logging
• Default Logging
• Google Cloud Log Explorer
• Log Analytics
• Log Routing and Storage
• Logging Pipelines

MODULE 5.3: VM & Storage Investigations

• Compute Overview
• VM Snapshots
• Explore Snapshots
• Google Logging Agent
• Ops Agent in Google Cloud
• Google Cloud Storage Buckets
• Bucket Permissions
• Bucket Privilege Escalation
• Bucket Object Logging

MODULE 5.4: Google Cloud Network Forensics

• GCP Network DFIR Services Overview
• GCP VPC Overview
• VPC Networking
• VPC Flow Logs
• Firewall Rules & Logging
• GCP Packet Mirroring

Module6: Multi-Cloud Intrusion Challenge

Overview

In the final section, students will split into teams to solve an intrusion that spans all three major cloud providers. Students will need to refer to all their new knowledge for the week and divide and conquer the evidence to find out how the intrusion occurred. Multiple interconnected cloud systems will be examined as students work to determine what happened.

Students will then present their findings to the class to determine which team will be deemed FOR509 Lethal Forensicators!

Prerequisites