Cloud Incident Response Playbook

# AWS CloudTrail IR Investigation
# Assumes CloudTrail is enabled (if not: your evidence is severely limited)

# 1. Find all API calls made by compromised access key
COMPROMISED_KEY="AKIAIOSFODNN7EXAMPLE"

aws logs filter-log-events \
    --log-group-name "aws-cloudtrail-logs-ACCOUNT-ID" \
    --filter-pattern "{ $.userIdentity.accessKeyId = \"$COMPROMISED_KEY\" }" \
    --start-time $(date -d "7 days ago" +%s000) \
    --output json > cloudtrail_compromised_key.json

# 2. Enumerate all IAM users/roles/keys created after compromise date
aws iam list-users --query 'Users[?CreateDate>`2026-08-01`]' --output table
aws iam list-roles  --query 'Roles[?CreateDate>`2026-08-01`]' --output table

# For each new user, list their access keys:
aws iam list-access-keys --user-name NEWUSER

# 3. Check what S3 data was accessed — requires S3 server access logging to be enabled
# If enabled: logs are in your designated S3 logging bucket
aws s3 ls s3://YOUR-ACCESS-LOG-BUCKET/ --recursive | grep "2026-08-"
# Then download and search the access logs for your bucket name and GET operations

# 4. Check for new EC2 instances (compute for C2 or crypto mining)
aws ec2 describe-instances \
    --filters "Name=launch-time,Values=2026-08-01T00:00:00*" \
    --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name,LaunchTime:LaunchTime,IP:PublicIpAddress}' \
    --output table

# AWS IAM containment — revoke a compromised key and deny all permissions

# 1. Deactivate the compromised access key
aws iam update-access-key \
    --access-key-id AKIAIOSFODNN7EXAMPLE \
    --status Inactive \
    --user-name jsmith

# 2. Attach an explicit DENY policy to the user (belt-and-suspenders with key disable)
cat > deny_all_policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*"
  }]
}
EOF
aws iam put-user-policy \
    --user-name jsmith \
    --policy-name IR-DenyAll \
    --policy-document file://deny_all_policy.json

# 3. Isolate a compromised EC2 instance — modify its security group to block all traffic
aws ec2 modify-instance-attribute \
    --instance-id i-0abcdef1234567890 \
    --groups sg-QUARANTINE-SG-ID  # a security group with no inbound/outbound rules

# 4. Preserve the compromised instance before stopping it
aws ec2 create-image \
    --instance-id i-0abcdef1234567890 \
    --name "IR-Forensic-Snapshot-$(date +%Y%m%d-%H%M)" \
    --no-reboot  # critical: don't reboot — preserves current disk state

# Azure Activity Log and Entra ID IR investigation

Connect-AzAccount
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All"

# 1. Azure Activity Log — all control-plane actions in the subscription
# (Portal: Monitor → Activity Log; or via API)
$startDate = "2026-08-01"
Get-AzActivityLog -StartTime $startDate -MaxRecord 1000 |
    Where-Object { $_.Status.Value -eq "Succeeded" } |
    Select-Object EventTimestamp, Caller, OperationName,
                  ResourceGroupName, ResourceProviderName |
    Sort-Object EventTimestamp |
    Format-Table

# 2. Find new role assignments (privilege escalation indicator)
Get-AzRoleAssignment |
    Where-Object { $_.CreatedOn -gt [DateTime]$startDate } |
    Select-Object DisplayName, RoleDefinitionName, Scope, CreatedOn |
    Sort-Object CreatedOn

# 3. Entra ID: new service principals (attacker may have registered an app)
Get-MgServicePrincipal -All |
    Where-Object { $_.CreatedDateTime -gt [DateTime]$startDate } |
    Select-Object DisplayName, AppId, CreatedDateTime |
    Sort-Object CreatedDateTime

# 4. Isolate an Azure VM — using JIT (Just-in-Time) access revocation and NSG
$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName "prod-rg" -Name "vm-nsg"
# Add a deny-all rule with highest priority (lower number = higher priority in Azure)
$rule = New-AzNetworkSecurityRuleConfig `
    -Name "IR-DenyAll" -Priority 100 -Direction Inbound `
    -Access Deny -Protocol * -SourceAddressPrefix * `
    -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange *
$nsg.SecurityRules.Add($rule)
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg