FOR509: Enterprise Cloud Forensics and Incident Response

Full Lab Details

• Lab 1.1: Analyze and Visualize data in SOF-ELK
• This lab serves as a guided demonstration to familiarize you with the Security Operations and Forensics ELK (SOF-ELK) platform. You will learn the basics of analyzing and visualizing log data within the SOF-ELK virtual machine, which is the primary tool used for all subsequent hands-on exercises in the course.
• Lab 1.2: Suspicious Email
• In this lab, you will investigate a business email compromise by searching Hank's mailbox for unauthorized access and malicious configuration changes. The analysis reveals that the threat actor created a forwarding rule to an impostor domain and a separate inbox rule to hide emails containing specific keywords.
• Lab 1.3: Data Theft
• This lab requires you to analyze a data theft scenario by tracking an attacker who searches a user's OneDrive and SharePoint for sensitive files. You will trace the threat actor's activity as they download multiple documents and delete others, learning to use the AADSessionId to differentiate the attacker's session from the legitimate user’s.
• Lab 1.4: Entra ID – UAL View
• This exercise focuses on exploring Microsoft Entra ID authentication logs as they appear within the Unified Audit Log (UAL). You will learn how to interpret these sign-in events while also discovering the limitations of the UAL, which contains fewer details than the equivalent logs found in the Azure portal.
• Lab 1.5: Graph API Application Activity
• In this lab, you will investigate how a threat actor leverages the Microsoft Graph API to create persistence mechanisms and steal data from an environment. You will learn that the Graph API activity log shows all requests made, including reconnaissance, but you must correlate these entries with other logs to see the results and impact of those API calls.

Full Topic Details

• Module 1.1: Course Introduction and SOF-ELK
• Purpose of the Class
• About the Labs
• SOF-ELK Architecture
• Logstash
• Module 1.2: Key Elements of Cloud for DFIR
• Cloud Models
• DFIR in the Cloud
• Common Cloud Concepts
• Shared Responsibility Model
• Key Logs for Investigations
• Cloud Access Options
• VM Disk Snapshots
• Cloud Flows
• Pricing
• Terminology Across Clouds
• Module 1.3: Microsoft 365 Unified Audit Log
• Unified Audit Log
• UAL Records
• Workload, Record Type, and Operation
• Accessing and Searching the UAL
• Exchange Workload
• Tracking Suspicious Emails
• Blocking Auto-forward Out of Domain
• File Operations and Sharing
• SharePoint Workload
• Track File Lifecycle
• SearchQuery Operation
• Entra ID
• Tokens Basics
• Module 1.4: Microsoft Graph API
• Case Study: SolarWinds
• Microsoft Graph API Process
• Graph API Process
• Five Steps to Graph API
• Examples Logs
• Read Emails
• Create a User
• Investigate your Environment

Full Lab Details

• Lab 2.1: Entra ID – Azure View
• This lab explores Microsoft Entra ID logs from the Azure portal, allowing you to compare them with the less-detailed versions found in the Microsoft 365 Unified Audit Log. You'll analyze various sign-in categories, including those generated by managed identities, to identify potentially suspicious identities created by a threat actor.
• Lab 2.2: Resource Tracking
• In this lab, you'll track a threat actor who creates a user-assigned managed identity and grants it an overly permissive "contributor" role at the resource group level. By following the audit and activity logs, you'll see how the actor uses this identity to create other resources, including an Azure Data Factory and a Key Vault, to prepare for data exfiltration.
• Lab 2.3: Virtual Machines and Snapshots
• This lab investigates the compromise of a virtual machine's managed identity after its token is stolen from the metadata service. You will analyze the activity logs to see how the threat actor uses this stolen identity's permissions to create new virtual machines, execute remote commands, and create and export snapshots of other systems.
• Lab 2.4: Detecting Data Exfiltration
• This lab focuses on detecting data exfiltration from an Azure storage account by analyzing the StorageRead logs, which must be manually enabled. You'll compare evidence from three different exfiltration methods used by the threat actor—Azure Storage Explorer, PowerShell, and Azure Data Factory—to understand their unique forensic artifacts.

Full Topic Details

• Module 2.1: Understanding Azure
• Tenant & Subscriptions
• Azure Resource Manager
• Resource Groups
• Azure Resource ID Strings
• Role Based Access Control
• Managed Identities
• Module 2.2: Log sources for IR
• Sources of Logs
• Azure Portal
• Sign-in Logs
• Audit Log
• Subscription/Activity Log
• Log Analytics Workspace
• Overview
• Log Analytics Queries
• KQL Examples
• Storage account
• PT1H in Storage Blobs
• Azure Storage Explorer
• Event Hubs and Graph API
• Module 2.3: Virtual Machines
• Virtual Machine Types
• Managed Disk
• Virtual Machine Creation Events
• Virtual Machine Agents
• Azure VM Run Command
• Imaging a Drive in the Cloud
• Download Snapshots
• Forensic VM Image Creation
• Module 2.4: Storage and Networking
• Storage Accounts
• Keys and Shared Access Signatures
• Azure Virtual Network
• Network Security Group
• Flow Logs
• Module 2.5: Resources
• Azure Sentinel
• Microsoft Incident Response Playbooks
• Azure Threat Research Matrix

Full Lab Details

• Lab 3.1: Reviewing CloudTrail Logs
• In this lab, students will make use of exported logs from CloudTrail to identify possible account takeovers. Reviewing multiple scenarios of console access and API key access, students will learn how to find and track these attacks. In this lab, you'll search through CloudTrail logs to find evidence of malicious IAM activity, such as user enumeration, permission changes, and the creation of new API keys. The investigation reveals that a compromised Azure user account was used to gain administrative access to the AWS organization, allowing the threat actor to create new malicious accounts.
• Lab 3.2: Finding Rogue VMs
• This exercise requires you to analyze CloudTrail logs for malicious activity related to virtual machines, such as the enumeration of existing EC2 instances and the creation of snapshots from sensitive systems. Your analysis will also uncover a rogue Lightsail instance created by the threat actor, a common tactic used to hide infrastructure because it doesn't appear in the EC2 Global View.
• Lab 3.3: VPC Flow Logs
• In this lab, you will analyze VPC flow logs and DNS resolver query logs to investigate an attacker's network activity. The investigation will reveal evidence of large-scale data exfiltration, as well as regular beaconing activity to a command-and-control server hosted on a separate VPS.
• Lab 3.4: S3 Analysis
• This lab requires you to analyze both CloudTrail and S3 server access logs to investigate malicious activity within S3 buckets. You will find evidence that the threat actor exfiltrated research data, modified bucket permissions for persistent access, and encrypted the data with their own key to lock out the legitimate owners.
• Lab 3.5: Tracking Lateral Movement
• In this lab, you will investigate how the threat actor moved laterally between systems in private subnets by analyzing logs from AWS Systems Manager (SSM) and Lambda. The logs reveal the use of EC2 Instance Connect for remote access and the creation of a malicious Lambda function designed as a persistence mechanism.

Full Topic Details

• Module 3.1: Understanding IR in AWS
• AWS Organizations
• IR Roles in Organizations
• Security Reference Architecture
• IAM: Identity and Access Management
• IAM vs. Root Accounts
• IAM Roles and Policies
• Analyzing IAM Policies
• IAM Policy Simulator
• Scoping IAM Access in Incidents
• Ways of Accessing AWS
• CloudTrail
• Downloading Default CloudTrail Logs
• Amazon Resource Name
• Access Keys Explained
• GuardDuty
• Module 3.2: Networking, VMs, and Storage
• EC2: Elastic Compute Cloud
• EC2 CloudTrail logs
• STS Tokens vs. IAM Roles
• Amazon Lightsail
• EBS: Elastic Block Store
• EBS CloudTrail Logs
• Snapshots
• Snapshot CloudTrail Logs
• EFS
• EFS CloudTrail Logs
• Virtual Networks
• VPCs
• VPC Subnets
• Security Groups vs. Network ACLs
• VPC Flow Logs
• Route 53
• S3 Buckets
• S3 Buckets
• AWS Transfer Acceleration
• S3 Bucket Access in CloudTrail
• S3 Bucket Access in Server Access Logs
• Module 3.3: AWS Native Log Searching
• AWS Log Sources
• AWS CloudTrail Lake
• AWS Glue
• AWS Athena
• AWS Detective
• Module 3.4: Event-Driven Response
• Lambda
• Event-Driven DFIR Automation
• CloudWatch Logs
• AWS Lambda Logs
• Event Triggers
• Step Functions
• Module 3.5: In-cloud IR
• AWS Systems Manager
• AWS Systems Manager Commands to Hunt For
• AWS Systems Manager Agent Logs

Full Lab Details

• Lab 4.1: Kubernetes Log Analysis
• This lab continues an intrusion scenario from a previous section, focusing on how a compromised AWS account can affect an associated EKS Kubernetes cluster. Students will track the threat actor's actions using the logs to understand how credentials compromised in the wider cloud environment can lead to the compromise of the cluster itself.
• Lab 4.2: Investigating a Compromised Container
• In this lab, students investigate the forensic artifacts from an attack where a publicly exposed "Damn Vulnerable Web Application" container was compromised by a crypto miner. The lab requires analyzing the evidence left behind, demonstrating why capturing stdout logs is critical to understanding what occurs within a container after a compromise.
• Lab 4.3: Google Workspace Business Email Compromise
• This lab requires students to explore Gmail and user audit logs to investigate a business email compromise that began with a successful phishing campaign. After identifying which users clicked the malicious link, the investigation follows the threat actor's post-compromise activity, including changing a user's password, 2FA settings, and enabling email forwarding for persistence.
• Lab 4.4: Google OAuth Abuse with Third-Party Apps
• This investigation begins by analyzing an alert that a user unexpectedly granted admin privileges via a suspicious third-party application using OAuth. Students will pivot from the token audit logs to Google Chat logs to identify the initial social engineering vector, where a malicious Python script was sent as an attachment and downloaded by the victim.
• Lab 4.4: LAB 4.5: Google Workspace Data Exfiltration
• In this lab, students will track both malicious data exfiltration and unintentional data exposure by analyzing Google Drive and Takeout logs. The investigation uncovers that the initial access vector was a misconfigured Google Group that any employee could join, which the threat actor used to gain permissions to change file sharing settings and steal data from a shared drive.

Full Topic Details

• Module 4.1: Kubernetes Overview and Logs
• Evolution of Platforms
• Containers/Pods/Nodes
• Clusters and Control Plane
• Networking in Kubernetes
• Logging within Kubernetes
• Kubernetes Implementation by Cloud
• Logs in Azure Kubernetes Service
• Logs in Amazon Elastic Kubernetes Service
• Logs in Google Kubernetes Engine
• Module 4.2: Common Kubernetes Attacks
• Kubernetes API Server Attacks
• Etcd Attacks
• Container Escape
• Container-Focused Attacks
• Module 4.3: Understanding Google Workspace
• Google Workspace Editions
• Google Workspace Organization Units
• Google Workspace Groups
• Google Workspace Privileges and Roles
• Module 4.4: Accessing Google Workspace Evidence
• Key Services
• Data Sources
• Data Retention and Lag Time
• Investigation Tool
• Reports API
• ALFA Overview
• Sending Audit Logs to Google Cloud
• Accessing Evidence via Vaul
• Module 4.5: Investigating Google Workspace
• Admin Audit Logs
• User Audit Logs
• Gmail Data Sources
• Importing Gmail Audit Logs into SOF-ELK
• Reviewing Emails via Investigation Tool
• OAuth Audit Logs
• Chat Audit Logs
• Drive Audit Logs
• Google Takeout

Full Topic Details

• Lab 5.1: Roles and Service Account Tracking
• In this lab, you will investigate the actions of a threat actor who accesses multiple service accounts and attempts to enumerate permissions. By analyzing the logs, you will trace how the actor moves between different service accounts and projects to escalate their privileges.
• Lab 5.2: Virtual Machines and Snapshots
• This lab focuses on tracking a threat actor's activities related to virtual machines, including the creation of a new instance and snapshots of existing disks. You will analyze log events to follow the actor's process of exporting snapshots and adding SSH keys to project metadata for persistent access.
• Lab 5.3: Storage Buckets and Data Exfiltration
• This lab focuses on investigating storage logs and understanding data exfiltration techniques. You will analyze how a threat actor lists and downloads numerous files from a storage bucket and review log entries related to ransomware tactics.
• Lab 5.4: Beacons, VPC Flows, and Firewall Logs
• In this lab, you will explore VPC flow logs and firewall logs to identify malicious network activity. You will analyze this data to find evidence of beaconing to a command-and-control server and probable data exfiltration from a compromised virtual machine.

Full Topic Details

• Module 5.1: Google Cloud Overview and IAM
• Google Cloud Structure
• Identity and Access Management
• Roles and Policies
• Policy Inheritance and Bindings
• Policy Analyzer
• Service Accounts
• Impersonation
• Organization Policies
• Module 5.2: Logging
• Log Categories
• Google Cloud Log Flow
• Logging Process
• Data Access Audit Logs
• Log Storage
• Log Routing Sink
• Case Study: Consolidated Log
• Filter Examples
• Log Explorer
• Gcloud Logging Command
• Copy Logs Directly to a Storage Bucket
• Exporting Logs via Pub/Sub
• Module 5.3: Virtual Machines
• Pre-defined compute engine types
• Block storage
• VM default service account
• VM creation log
• Snapshot creation
• Snapshot export
• Cloud Ops agent
• Module 5.4: Cloud Storage and Networking
• Cloud Storage Buckets
• Bucket Metadata
• Bucket Logs
• Bucket Privilege Escalation
• Filestore
• VPC Network
• VPC Flow Log
• VPC Firewall

You must divide and conquer the evidence across multiple interconnected systems to determine the full scope of the incident. The challenge concludes with each team presenting its findings to the class to determine who will be named the FOR509 Lethal Forensicators.