Cloud Audit Logs

# AWS CloudTrail — logs all AWS API calls
# Default retention: 90 days in CloudTrail console
# Long-term: logs delivered to S3 bucket as gzip JSON files

# Prerequisite: AWS CLI configured with read-only investigation role
PROFILE="--profile forensics-readonly"
REGION="--region us-east-1"
START="2026-09-17T00:00:00Z"
END="2026-09-18T00:00:00Z"

# Step 1: Find all events for a suspicious access key
ACCESS_KEY="AKIA1234567890EXAMPLE"
aws cloudtrail lookup-events \
    $PROFILE $REGION \
    --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=$ACCESS_KEY \
    --start-time $START --end-time $END \
    --output json | jq '.Events[] | {time: .EventTime, name: .EventName, source: .SourceIPAddress}'

# Step 2: Find unusual IAM activity (new users, policy changes)
aws cloudtrail lookup-events \
    $PROFILE $REGION \
    --lookup-attributes AttributeKey=EventSource,AttributeValue=iam.amazonaws.com \
    --start-time $START --end-time $END \
    --output json | jq '.Events[] | {time: .EventTime, event: .EventName, user: .Username, ip: .SourceIPAddress}'

# Step 3: Find S3 data access events (requires S3 data event logging)
aws cloudtrail lookup-events \
    $PROFILE $REGION \
    --lookup-attributes AttributeKey=EventSource,AttributeValue=s3.amazonaws.com \
    --start-time $START --end-time $END \
    --output json | \
    jq '.Events[] | select(.EventName | test("GetObject|ListBucket|PutObject")) |
        {time: .EventTime, event: .EventName, bucket: .Resources[0].ResourceName, ip: .SourceIPAddress}'

# Step 4: Query CloudTrail S3 logs with Athena (for large-scale analysis)
# Create Athena table over CloudTrail S3 prefix and run SQL

#!/usr/bin/env python3
"""
Parse CloudTrail JSON logs from S3 bucket (downloaded to local)
Identify: credential theft, privilege escalation, data exfiltration
"""
import json
import gzip
import os
from datetime import datetime
from collections import defaultdict

LOG_DIR = "/cases/CASE-2026-009/cloudtrail/"

SUSPICIOUS_EVENTS = {
    "iam.amazonaws.com": [
        "CreateUser", "CreateAccessKey", "AttachUserPolicy",
        "AttachRolePolicy", "PutUserPolicy", "CreateRole",
        "AddUserToGroup", "UpdateLoginProfile"
    ],
    "s3.amazonaws.com": [
        "GetObject", "PutObject", "DeleteObject",
        "CreateBucket", "PutBucketPolicy"
    ],
    "sts.amazonaws.com": [
        "AssumeRole", "AssumeRoleWithWebIdentity",
        "GetSessionToken", "GetFederationToken"
    ],
    "ec2.amazonaws.com": [
        "RunInstances", "CreateSecurityGroup", "AuthorizeSecurityGroupIngress",
        "ModifyInstanceAttribute"
    ]
}

events = []
for fname in os.listdir(LOG_DIR):
    if fname.endswith('.json.gz'):
        with gzip.open(os.path.join(LOG_DIR, fname)) as f:
            data = json.load(f)
            events.extend(data.get('Records', []))

print(f"Total events: {len(events)}")

# Group events by principal + source IP
activity = defaultdict(list)
for e in events:
    principal = (e.get('userIdentity', {}).get('arn', 'unknown') +
                 " from " + e.get('sourceIPAddress', 'unknown'))
    activity[principal].append(e)

# Report suspicious principal activity
print("\n=== SUSPICIOUS ACTIVITY SUMMARY ===")
for principal, evts in sorted(activity.items(), key=lambda x: -len(x[1])):
    suspicious = []
    for e in evts:
        src = e.get('eventSource', '')
        name = e.get('eventName', '')
        if src in SUSPICIOUS_EVENTS and name in SUSPICIOUS_EVENTS[src]:
            suspicious.append(f"{e['eventTime']}: {name}")

    if suspicious:
        print(f"\n  Principal: {principal}")
        print(f"  Total events: {len(evts)}, Suspicious: {len(suspicious)}")
        for s in suspicious[:10]:
            print(f"    {s}")

# M365 Unified Audit Log — covers: Exchange, SharePoint, Teams, Azure AD, Defender
# Requires: Exchange Online PowerShell module
# Role required: Audit Log Reader or higher

Connect-ExchangeOnline -UserPrincipalName "admin@corp.com"

$Start = "2026-09-17T00:00:00"
$End   = "2026-09-18T00:00:00"

# Search for suspicious inbox rule creation (BEC indicator)
$inboxRules = Search-UnifiedAuditLog \
    -StartDate $Start -EndDate $End \
    -Operations "New-InboxRule", "Set-InboxRule" \
    -ResultSize 500

$inboxRules | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time        = $_.CreationDate
        User        = $_.UserIds
        Operation   = $_.Operations
        RuleName    = $data.Parameters | Where-Object {$_.Name -eq "Name"} | Select-Object -Expand Value
        ForwardTo   = $data.Parameters | Where-Object {$_.Name -like "Forward*"} | Select-Object -Expand Value
    }
} | Where-Object { $_.ForwardTo } | Format-Table

# Suspicious file access in SharePoint
$sharePointAccess = Search-UnifiedAuditLog \
    -StartDate $Start -EndDate $End \
    -RecordType SharePoint \
    -Operations "FileAccessed", "FileDownloaded", "FilePreviewed" \
    -ResultSize 1000

# Group by user to find mass download
$sharePointAccess |
    Group-Object UserIds |
    Sort-Object Count -Descending |
    Select-Object Name, Count |
    Where-Object { $_.Count -gt 50 } |  # More than 50 file accesses = suspicious
    Format-Table

# OAuth app consent grants (attacker-added persistent app access)
Search-UnifiedAuditLog \
    -StartDate $Start -EndDate $End \
    -Operations "Consent to application" \
    -ResultSize 100 |
    Select-Object CreationDate, UserIds, AuditData |
    Format-List