performing-cloud-forensics-investigation

执行云取证调查

适用场景

• 在调查 AWS、Azure 或 GCP 云环境中的安全漏洞时
• 从云基础设施中收集易失性和非易失性证据时
• 通过云服务 API 日志追踪未授权访问时
• 在需要保全基于云的证据的事件响应期间
• 分析已被入侵的虚拟机、容器或无服务器函数时

前提条件

• 对正在调查的云账户具有管理访问权限
• 已配置具有适当权限的 AWS CLI、Azure CLI 或 gcloud CLI
• 了解云原生日志记录（CloudTrail、Activity Log、Audit Log）
• 已安装云 SDK 的取证工作站
• 了解目标云中的 IAM、网络和计算服务
• 云环境的证据保全流程

工作流

步骤 1：保全云证据并确定范围

# === AWS Evidence Preservation ===
# Snapshot compromised EC2 instance volumes
INSTANCE_ID="i-0abc123def456789"
VOLUME_IDS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
   --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' --output text)

for vol in $VOLUME_IDS; do
   aws ec2 create-snapshot --volume-id $vol \
      --description "Forensic snapshot - Case 2024-001 - $(date -u)" \
      --tag-specifications "ResourceType=snapshot,Tags=[{Key=Case,Value=2024-001},{Key=Evidence,Value=true}]"
done

# Capture instance metadata
aws ec2 describe-instances --instance-ids $INSTANCE_ID \
   > /cases/case-2024-001/cloud/instance_metadata.json

# Capture security group rules
aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances \
   --instance-ids $INSTANCE_ID --query 'Reservations[].Instances[].SecurityGroups[].GroupId' --output text) \
   > /cases/case-2024-001/cloud/security_groups.json

# Capture network interfaces
aws ec2 describe-network-interfaces --filters "Name=attachment.instance-id,Values=$INSTANCE_ID" \
   > /cases/case-2024-001/cloud/network_interfaces.json

# Isolate the instance (replace security group with forensic isolation SG)
aws ec2 modify-instance-attribute --instance-id $INSTANCE_ID \
   --groups sg-forensic-isolation

# === Azure Evidence Preservation ===
# Snapshot a compromised VM disk
az snapshot create --resource-group forensics-rg \
   --name "case-2024-001-osdisk-snapshot" \
   --source "/subscriptions/SUB_ID/resourceGroups/RG/providers/Microsoft.Compute/disks/vm-osdisk"

# === GCP Evidence Preservation ===
gcloud compute disks snapshot compromised-disk \
   --snapshot-names="case-2024-001-forensic" \
   --zone=us-central1-a

步骤 2：收集云 API 和访问日志

# === AWS CloudTrail Logs ===
# Download CloudTrail events for the investigation period
aws cloudtrail lookup-events \
   --start-time "2024-01-15T00:00:00Z" \
   --end-time "2024-01-20T23:59:59Z" \
   --max-results 1000 \
   > /cases/case-2024-001/cloud/cloudtrail_events.json

# Filter for specific user activity
aws cloudtrail lookup-events \
   --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
   --start-time "2024-01-15T00:00:00Z" \
   > /cases/case-2024-001/cloud/user_activity.json

# Download S3 access logs
aws s3 sync s3://my-cloudtrail-bucket/AWSLogs/ /cases/case-2024-001/cloud/cloudtrail_s3/

# Query CloudTrail with Athena for large-scale analysis
aws athena start-query-execution \
   --query-string "SELECT eventTime, eventName, userIdentity.arn, sourceIPAddress, errorCode
                   FROM cloudtrail_logs
                   WHERE eventTime BETWEEN '2024-01-15' AND '2024-01-20'
                   AND sourceIPAddress NOT IN ('10.0.0.0/8')
                   ORDER BY eventTime" \
   --result-configuration OutputLocation=s3://forensics-bucket/athena-results/

# === AWS VPC Flow Logs ===
aws logs filter-log-events \
   --log-group-name "vpc-flow-logs" \
   --start-time $(date -d "2024-01-15" +%s000) \
   --end-time $(date -d "2024-01-20" +%s000) \
   --filter-pattern "ACCEPT" \
   > /cases/case-2024-001/cloud/vpc_flow_logs.json

# === Azure Activity Log ===
az monitor activity-log list \
   --start-time "2024-01-15T00:00:00Z" \
   --end-time "2024-01-20T23:59:59Z" \
   --output json > /cases/case-2024-001/cloud/azure_activity.json

# === GCP Audit Logs ===
gcloud logging read 'logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity"
   AND timestamp>="2024-01-15T00:00:00Z"
   AND timestamp<="2024-01-20T23:59:59Z"' \
   --format=json > /cases/case-2024-001/cloud/gcp_audit.json

步骤 3：分析 IAM 和访问模式

# Analyze compromised credentials usage
python3 << 'PYEOF'
import json
from collections import defaultdict

with open('/cases/case-2024-001/cloud/cloudtrail_events.json') as f:
    data = json.load(f)

# Analyze by source IP
ip_events = defaultdict(list)
error_events = []
critical_actions = []

for event in data.get('Events', []):
    ct = json.loads(event.get('CloudTrailEvent', '{}'))
    source_ip = ct.get('sourceIPAddress', 'Unknown')
    event_name = ct.get('eventName', 'Unknown')
    user_arn = ct.get('userIdentity', {}).get('arn', 'Unknown')
    error = ct.get('errorCode')
    timestamp = ct.get('eventTime', '')

    ip_events[source_ip].append(event_name)

    if error:
        error_events.append({'time': timestamp, 'action': event_name, 'error': error, 'ip': source_ip})

    # Flag critical actions
    critical = ['CreateUser', 'CreateAccessKey', 'AttachUserPolicy', 'CreateRole',
                'PutBucketPolicy', 'StopLogging', 'DeleteTrail', 'CreateKeyPair',
                'RunInstances', 'AuthorizeSecurityGroupIngress']
    if event_name in critical:
        critical_actions.append({'time': timestamp, 'action': event_name, 'user': user_arn, 'ip': source_ip})

print("=== SOURCE IP ANALYSIS ===")
for ip, events in sorted(ip_events.items(), key=lambda x: len(x[1]), reverse=True):
    print(f"  {ip}: {len(events)} events ({len(set(events))} unique actions)")

print(f"\n=== ACCESS ERRORS ({len(error_events)} total) ===")
for e in error_events[:10]:
    print(f"  [{e['time']}] {e['action']} -> {e['error']} from {e['ip']}")

print(f"\n=== CRITICAL ACTIONS ({len(critical_actions)} total) ===")
for a in critical_actions:
    print(f"  [{a['time']}] {a['action']} by {a['user']} from {a['ip']}")
PYEOF

步骤 4：获取并分析 VM 磁盘镜像

# Create a forensic analysis instance from the snapshot
SNAPSHOT_ID="snap-0abc123def456789"

# Create volume from snapshot in isolated forensic VPC
FORENSIC_VOL=$(aws ec2 create-volume --snapshot-id $SNAPSHOT_ID \
   --availability-zone us-east-1a \
   --tag-specifications "ResourceType=volume,Tags=[{Key=Case,Value=2024-001}]" \
   --query 'VolumeId' --output text)

# Attach to forensic analysis instance (read-only mount)
aws ec2 attach-volume --volume-id $FORENSIC_VOL \
   --instance-id i-forensic-workstation \
   --device /dev/xvdf

# On the forensic instance, mount read-only
sudo mount -o ro /dev/xvdf1 /mnt/evidence

# Perform standard disk forensics on the mounted volume
# Extract logs, analyze file system, check for persistence
ls /mnt/evidence/var/log/
cp -r /mnt/evidence/var/log/ /cases/case-2024-001/cloud/vm_logs/
cp -r /mnt/evidence/etc/crontab /cases/case-2024-001/cloud/persistence/
cp -r /mnt/evidence/home/*/.ssh/ /cases/case-2024-001/cloud/ssh_keys/
cp -r /mnt/evidence/home/*/.bash_history /cases/case-2024-001/cloud/bash_history/

步骤 5：生成云取证报告

# Compile findings into structured report
python3 << 'PYEOF'
report = """
CLOUD FORENSICS INVESTIGATION REPORT
======================================
Case: 2024-001
Cloud Provider: AWS (Account: 123456789012)
Region: us-east-1
Investigation Period: 2024-01-15 to 2024-01-20

EVIDENCE PRESERVED:
- EC2 Instance Snapshot: snap-0abc123def456789 (i-0abc123def456789)
- CloudTrail Logs: 2024-01-15 to 2024-01-20
- VPC Flow Logs: 2024-01-15 to 2024-01-20
- Instance Metadata: captured and hashed
- Security Group Configuration: captured at time of isolation

FINDINGS:
1. Initial Access:
   - Compromised IAM access key AKIA... used from IP 203.0.113.45
   - First unauthorized API call: 2024-01-15 14:32:00 UTC
   - IP geolocation: Foreign jurisdiction (not company IP range)

2. Persistence:
   - New IAM user 'backup-admin' created with AdministratorAccess
   - New access key pair generated for backup-admin
   - SSH key added to EC2 instance authorized_keys

3. Lateral Movement:
   - S3 bucket policies modified to allow public access
   - Security group rules modified to allow SSH from 0.0.0.0/0
   - 3 additional EC2 instances launched for crypto-mining

4. Data Exfiltration:
   - S3 bucket 'company-confidential' accessed 234 times
   - 12 GB of data downloaded via GetObject API calls
   - Data transferred to external IP 185.x.x.x

5. Anti-Forensics:
   - CloudTrail logging disabled at 2024-01-18 03:00 UTC
   - CloudWatch log groups deleted

RECOMMENDATIONS:
- Rotate all IAM credentials immediately
- Enable MFA on all accounts
- Restore CloudTrail logging
- Review and restrict S3 bucket policies
- Implement GuardDuty for continuous monitoring
"""

with open('/cases/case-2024-001/cloud/cloud_forensics_report.txt', 'w') as f:
    f.write(report)
print(report)
PYEOF

核心概念

概念	描述
云 API 日志记录	记录所有 API 调用的服务日志（CloudTrail、Activity Log、Audit Log）
卷快照	用于取证保全的云磁盘卷时间点副本
VPC Flow Logs	显示源、目标和操作的网络流量元数据日志
IAM 凭据泄露	未授权使用访问密钥、令牌或代入角色
实例元数据	EC2/VM 配置数据，包括网络、存储和安全设置
责任共担	云提供商保护基础设施；客户保护数据和访问
证据易失性	云资源可能被终止；必须快速保全证据
多区域产物	攻击可能跨越多个区域，需要跨区域日志收集

工具与系统

工具	用途
AWS CLI	用于 AWS 服务交互和日志收集的命令行界面
CloudTrail	用于调查和审计的 AWS API 调用日志记录服务
Azure Monitor	Azure 日志记录和诊断平台
GCP Cloud Logging	Google Cloud 审计和访问日志记录服务
Athena	用于大规模分析 CloudTrail 日志的 AWS 无服务器 SQL 查询服务
Prowler	开源 AWS 安全评估和取证收集工具
ScoutSuite	多云安全审计工具
CADO Response	云原生数字取证和事件响应平台

常见场景

场景 1：IAM 访问密钥泄露 在 CloudTrail 中识别泄露的密钥，追踪使用该密钥进行的所有 API 调用，确定源 IP 和所采取的操作，检查持久化机制（新用户、角色、密钥），撤销泄露的凭据，评估数据访问范围。

场景 2：EC2 实例上的挖矿劫持 在 CloudTrail 中检测未授权的实例启动，对挖矿实例创建快照以进行分析，检查允许 C2 通信的安全组变更，识别初始访问途径（被盗密钥、SSRF），计算产生的资源成本。

场景 3：S3 数据泄露 分析 S3 访问日志和 CloudTrail 中的 GetObject/PutBucketPolicy 事件，识别修改存储桶策略以允许公开访问的人员，确定数据暴露范围，检查来自未授权 IP 的数据下载，评估监管报告要求。

场景 4：EKS/AKS/GKE 中的容器逃逸 收集 Kubernetes 审计日志和云提供商日志，分析 Pod 创建事件以发现权限提升尝试，检查节点级日志以寻找容器逃逸证据，检查对云元数据服务（169.254.169.254）的未授权访问，追踪向云 API 的横向移动。

输出格式

Cloud Forensics Summary:
  Cloud: AWS (us-east-1) Account: 123456789012
  Investigation: 2024-01-15 to 2024-01-20
  Incident Type: IAM Credential Compromise + Data Exfiltration

  Evidence Collected:
    EBS Snapshots:    3 volumes preserved
    CloudTrail Events: 12,456 (1,234 from attacker IP)
    VPC Flow Logs:    45,678 records
    S3 Access Logs:   2,345 entries

  Attack Timeline:
    2024-01-15 14:32 - Compromised access key first used from 203.0.113.45
    2024-01-15 14:45 - New IAM user created with admin privileges
    2024-01-16 02:00 - S3 bucket policy modified (public access enabled)
    2024-01-16 03:00 - 12 GB downloaded from company-confidential bucket
    2024-01-18 03:00 - CloudTrail logging disabled

  Impact Assessment:
    Data Exposed: 12 GB from 3 S3 buckets
    Resources Created: 3 EC2 instances (crypto mining)
    Estimated Cost: $4,500 in unauthorized compute