New

FOR509: Enterprise Cloud Forensics and Incident Response

GIAC Cloud Forensics Responder (GCFR)
GIAC Cloud Forensics Responder (GCFR)
  • In Person (6 days)
  • Online
36 CPEs

The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner's ability to directly access systems and use classical data extraction methods. Unfortunately, many examiners are still trying to force old methods for on-premise examination onto cloud-hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources. FOR509: Enterprise Cloud Forensics and Incident Response addresses today's need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.

What You Will Learn

Find the Storm in the Cloud

FOR509: Enterprise Cloud Forensics and Incident Response will help you:

  • Understand forensic data only available in the cloud
  • Implement best practices in cloud logging for DFIR
  • Learn how to leverage Microsoft Azure, AWS and Google Cloud Platform resources to gather evidence
  • Understand what logs Microsoft 365 and Google Workspace have available for analysts to review
  • Learn how to move your forensic processes to the cloud for faster data processing

With FOR509: Enterprise Cloud Forensics and Incident Response, examiners will learn how each of the major cloud service providers (Microsoft Azure, Amazon AWS and Google Cloud Platform) are extending analyst's capabilities with new evidence sources not available in traditional on-premise investigations. From cloud equivalents of network traffic monitoring to direct hypervisor interaction for evidence preservation, forensics is not dead. It is reborn with new technologies and capabilities.

Incident response and forensics are primarily about following breadcrumbs left behind by attackers. These breadcrumbs are primarily found in logs. Your knowledge of the investigation process is far more important than the mechanics of acquiring the logs.

This class is primarily a log analysis class to help examiners come up to speed quickly with cloud based investigation techniques. It's critical to know which logs are available in the cloud, whether they are turned on by default, and how to interpret the meaning of the events they contain.

Numerous hands-on labs throughout the course will allow examiners to access evidence generated based on the most common incidents and investigations. Examiners will learn where to pull data from and how to analyze it to find evil. The data will be available in your VM rather than accessed directly via the cloud to ensure a consistent lab experience.

FOR509 ENTERPRISE CLOUD FORENSICS WILL PREPARE YOUR TEAM TO:

  • Learn and master the tools, techniques, and procedures necessary to effectively locate, identify, and collect data no matter where it is located
  • Identify and utilize new data only available from cloud environments
  • Utilize cloud-native tools to capture and extract traditional host evidence
  • Quickly parse and filter large data sets using scalable technologies such as the Elastic Stack
  • Understand what data is available in various cloud environments

FOR509 ENTERPRISE CLOUD FORENSICS COURSE TOPICS

  • Cloud Infrastructure and IR data sources
  • Microsoft 365 and Graph API Investigations
  • Azure Incident Response
  • AWS Incident Response
  • Google Workspace Investigations
  • GCP Incident Response

WHAT YOU WILL RECEIVE

  • SOF-ELK(R) Virtual Machine - a publicly available appliance running the Elastic Stack and the course author's custom set of configurations and lab data. The VM is preconfigured to ingest cloud logs from Microsoft 365, Azure, AWS, Google Workspace and GCP. It will be used during the class to help students wade through the large number of records they are likely to encounter during a typical investigation.
  • Case data to examine during class.
  • Electronic workbook with detailed step-by-step instructions and examples to help you master cloud forensics

WHAT TO TAKE NEXT

Syllabus (36 CPEs)

Download PDF
  • Overview

    There is a universe of data out there to be discovered

    Before you can begin exploring the universe of cloud data, you must learn where and how it exists. In this section, you will learn about the most popular cloud architectures (IaaS, PaaS, SaaS) and how each changes your investigative possibilities. You will understand what logging and data access is provided by each cloud architecture and how to extract and process this data.

    We will introduce SOF-ELK, an open-source SIEM made for enterprise log analysis that easily extends into cloud forensics. We then go into Microsoft 365 which is a SaaS platform that provides the Microsoft Office suite of applications, including Excel and Word. In addition, Microsoft 365 implements several communications and collaboration tools such as Exchange, SharePoint, and Teams. We finish the day by exploring the Microsoft Graph API and reviewing the logs that it generates.

    Exercises

    LAB 0: Install SOF-ELK VM

    Prior to the class, students are expected to install the SOF-ELK VM with all the updates including the electronic workbook.

    LAB 1.1: Visualize data in SOF-ELK

    In this lab, students will learn how to search and visualize data in Kibana. They will also learn how to create their own dashboard. Kibana dashboards allow analysts to display summarized statistics and predefined filters for specific scenarios.

    LAB 1.2: Explore the UAL

    Students will review Unified Audit Logs in SOF-ELK to find the source of a business email compromise. Utilizing user agents, IP geolocation and source IP addresses students will be able to profile and identify hostile agents.

    LAB 1.3: Privilege Escalation with Graph API

    The Graph API is a powerful way to interact with the Microsoft cloud (both Microsoft 365 and Azure). Understanding the permissions granted to a Graph API application is critical to eliminating blind spots and solving incidents. In this exercise we will track how Graph API permissions were abused to grant a user the Global Admin role.

    Topics

    MODULE 1.1: Introducing SOF-ELK

    • SOF-ELK architecture
    • Logstash
    • Search process
    • Filtering in Kibana
      • dashboards
      • discover
      • visualize

    MODULE 1.2: Key Elements of Cloud for DFIR

    • MITRE ATT&CK® Cloud Matrix
    • Common attacks
    • Logs in different types of clouds: IaaS, PaaS, SaaS
    • DFIR in the cloud: New possibilities
    • Common cloud concepts
      • Shared responsibility model
      • Cloud access options
      • Snapshots
      • NetFlow
      • Pricing models
    • Terminology across clouds

    MODULE 1.3: Microsoft 365 Unified Audit Log

    • Connecting a PowerShell session to Microsoft 365
    • Properties of the UAL
    • Searching the UAL
    • UAL Workloads
      • SharePoint
      • Teams
      • OneDrive
    • Special example: Exchange workload
    • Azure Active Directory

    MODULE 1.4: Microsoft Graph API

    • Case study: SolarWinds
    • Graph API Process
    • Five steps to Graph API
    • Examples logs
      • Read emails
      • Create a user
    • What's logged?
    • Investigate your environment

  • Overview

    One of the most popular cloud providers for large enterprises is the Microsoft Azure cloud. Azure offers an impressive array of services and with that comes numerous data sources for us to explore. In this section we will learn about Azure tenant, subscription, and diagnostics logs. Finally, we will find out how to deploy our own analysis tools in the cloud.

    Exercises

    LAB 2.1: Using SOF-ELK with Azure Logs

    In this lab, students will explore the azure index and discover the users and machines of pymtechlabs.com.

    LAB 2.2: AAD Password Spray Attack

    In this lab, students will gain experience with the Azure Active Directory logs and identify a password spray attack.

    LAB 2.3: Tracking Resource Creations

    In this lab, students will see an example of virtual machines being created for the purpose of crypto mining by exploring the subscription log.

    LAB 2.4: Detecting Data Exfiltration

    In this lab, students will track data exfiltration through NSG flow logs and storage logs.

    Topics

    MODULE 2.1: Understanding Azure

    • Azure structure
    • Subscriptions
    • Azure Resource Manager
    • Resource groups
    • Key Resources for DFIR
    • Azure Resource ID Strings
    • Role Based Access Control
    • MITRE ATT&CK and Azure
    • Accessing Microsoft Azure
      • Portal
      • CLI
      • PowerShell
    • DFIR evidence in Cloud Shell

    MODULE 2.2: Networking, VMs, and Storage

    • Azure compute
    • Virtual machine types
    • Managed disk
    • Case Study: crypto mining VM
    • Azure virtual network
    • Network security group
    • Storage account
    • Storage blobs

    MODULE 2.3: Log sources for IR

    • Sources of logs
    • Log Analytics workspace
    • Tenant logs
      • Sign-in logs
      • Successful and failed login examples
      • Audit log
      • Log analytics queries
      • Case study: Impossible logins
      • Azure Storage Explorer
      • Export to JSON
      • Import into SOF-ELK
      • Event Hubs
      • Graph API
    • Subscription logs
      • Log schema
      • Viewing the activity log in the portal
      • Log analytics examples
      • Storage account and event hubs
      • Import into SOF-ELK
    • Resource logs
      • NSG Flow Log
      • Traffic Analytics
      • Import into SOF-ELK
      • Storage account logs
      • Data exfiltration

    MODULE 2.4: Virtual Machine Logs

    • Windows Agents
    • Windows Azure Diagnostics (WAD)
    • WAD Event Log Table
    • Importing into SOF-ELK
    • Search for User Login
    • Visualization example
    • Linux Logs
    • Importing into SOF-ELK
    • VM Insights

    MODULE 2.5: In-cloud IR

    • Imaging a drive in the cloud
    • In-Cloud investigations
      • Snapshots
      • Create a forensic VM
      • Run forensic tools
    • Forensic VM portability
    • Exporting snapshots
    • Other Azure resources
      • Azure Sentinel
      • Azure SimuLand
      • Microsoft incident response playbooks
      • Recommended open-source projects

  • Overview

    Now that we understand what's possible in the Cloud and the new DFIR evidence sources that exist for us, it's time to turn to the market leader in Cloud services. In this section we will explore how AWS can be used for the responder, how to deploy your own analysis system into your region, the new and relevant log sources for your investigation and how to bring it all together in lab scenarios designed to help you quickly solve the most common AWS cases.

    Exercises

    LAB 3.1: Reviewing CloudTrail Logs

    In this lab, students will make use of exported logs from CloudTrail to identify possible account takeovers. Reviewing multiple scenarios of console access and api key access, students will learn how to find and track these attacks.

    LAB 3.2: Finding Rogue VMs

    In this lab, students will make use of exported CloudTrail logs to locate newly created EC2 instances of different types created by attackers.

    LAB 3.3: VPC Flow Logs

    In this lab, students will use VPC Flow logs to find evidence of large data exfiltration. As a bonus, students can also attempt to find beacon traffic to define the indicators of compromise.

    LAB 3.4: S3 Analysis

    In this lab, students will make use of S3 Access logs to find evidence of data exfiltration from S3 buckets.

    LAB 3.5: Tracking Lateral Movement

    In this lab, students will use multiple log sources in order to follow an incident from initial IAM exposure to data access.

    Topics

    MODULE 3.1: Understanding AWS

    • Organizations
    • IAM
    • Shared Responsibility Model
    • CloudTrail
    • CloudTrail access methods
    • CloudTrail pricing
    • Threat Hunting in CloudTrail
    • GuardDuty

    MODULE 3.2: Networking, VMs, and Storage

    • Virtual Compute
      • EC2 types
      • EC2 CloudTrail logs
    • Virtual Storage
      • EBS types
      • EBS CloudTrail Logs
      • Snapshots
      • Snapshot Pricing
      • Snapshot CloudTrail Logs
      • EFS types
      • EFS CloudTrail Logs
    • Virtual Networks
    • VPCs
    • Subnets
    • VPC Flow Logs
    • VPC Flow Log Pricing
    • Route 53 - AWS DNS
    • S3 Buckets
      • Methods of Access
      • Policies
      • DFIR Usage
      • S3 Access Logs
      • S3 Access Logs Pricing

    MODULE 3.3: Log sources for IR

    • AWS Log Sources
    • Athena & Glue
    • AWS Detective

    MODULE 3.4: Event Drive Response

    • Lambda
    • Step Functions
    • Event Triggers
    • Event Driven DFIR Automation

    MODULE 3.5: In-cloud IR

    • Creating IR VMs
    • AWS systems manager
    • Capturing Memory
    • Regions and response
    • Containers
      • AKS
      • ECS
    • Most common investigations

  • Overview

    As one of the first SaaS solutions for organizations dating back to 2006, Google Workspace has a wide array of evidence artifacts for investigators to use when conducting incident response or internal investigations. Knowing the various locations to extract evidence, and how that evidence differs depending on where it's extracted, form one of the key concepts for Google Workspace investigations. Students will see four of the most common attacks in Google Workspace and how to investigate those attacks in depth.

    As with all the cloud platforms, students will see the limitations of preserved evidence and how to extend the lifetime of evidence in Google Workspace. Students will get hands-on access to evidence and be taught skills for how to best analyze Google Workspace evidence.

    Exercises

    LAB 4.1: Google Workspace Admin BEC

    In this lab, students will analyze exported Google Workspace audit and email logs to investigate an admin account compromise and determine post-compromise activities.

    LAB 4.2: OAuth Abuse with Third-Party Apps

    In this lab, students will investigate a suspicious OAuth application and the actions performed using its granted permissions.

    LAB 4.3: Google Workspace Data Exposure

    In this lab, students will review exported Google Drive audit logs to identify permissions issues and suspicious activity related to corporate files and folders.

    LAB 4.4: Collecting Workspace Logs in GCP via CLI

    This lab is a live walkthrough for accessing the Google Cloud Platform to extract logs from Google Workspace. It involves directly collecting evidence across the internet ready for an investigator to analyze.

    Topics

    MODULE 4.1: Understanding Google Workspace

    • Google's Footprint and Shared Responsibility
    • The History of Google Workspace
    • Google Workspace Services
    • Workspace Editions, Permissions, and Structure
    • Google Workspace Groups & Permissions

    MODULE 4.2: Google Workspace Evidence

    • Workspace Admin Logs and SDK
    • Collecting Logs from Workspace
    • Workspace Admin Audit Logs
    • Sending Workspace Logs to GCP
    • Setting up Access for API Log Collection
    • Collecting Logs via API

    MODULE 4.3: ATT&CKing Workspace

    • Attacks against Google Workspace
    • Workspace Detections & Automated Alerts
    • Email Compromise Investigation
      • Email Log Analysis
      • Google Vault Analysis
      • Advanced Phishing & Malware
    • Super Admin Takeover Investigations
      • Workspace Audit Log Rules and Retention
      • Login and User Audit Log Analysis
    • Third-Party App Abuse Investigations
      • What is OAuth
      • OAuth Abuse with Third-Party App
      • Workspace Token Logging and Containme
    • Data Exposure / Leakage / Exfil Investigations
      • Google Drive Investigation Tools
      • Drive File Recovery
      • Drive Audit and API Logging
      • Takeout Data Exfil
      • Takeout Audit and API Logging
      • Customer Takeout Exfil

    MODULE 4.4: Workspace Evidence in GCP

    • GCP CLI Tools for Log Collection
    • Setting up CLI Access to GCP
    • gcloud Log Collection

  • Overview

    Google Cloud Platform (GCP) offers many services and fundamentally changes how identity access management is treated compared to AWS and Azure, along with building in a lot of security and evidence items that are extremely useful to an incident response team. Using a combination of the GCP platform, its built-in auditing, agent-based logging, and external log analysis tools like ELK. This section will teach DFIR professionals with limited knowledge of GCP how to conduct investigations into common attacks on GCP.

    Exercises

    LAB 5.1: GCP IAM and Access Tracking

    Using the GCP Audit Logs, students will learn to profile, analyze, and summarize login sources with Kibana and GCP logs.

    LAB 5.2: Google VM Logging Agent - Agent Log Analysis

    Students will learn about the logs produced by GCP's Agent Logs and how to use them for analyzing a compromised system VM within GCP.

    LAB 5.3: Storage Abuse and Exfil

    Students will learn about the type of logs available to track GCP Storage Bucket exfiltration, along with additional techniques to track exfiltration when additional auditing logs are not enabled.

    LAB 5.4: Network Forensics in GCP

    Students will learn about the networking logs and data available with GCP and how to use this evidence to conduct Network Forensics for a GCP environment.

    Topics

    MODULE 5.1: Understanding GCP

    • Organizations
    • GCP Resources
    • Pricing Considerations
    • GCP identity and access management (IAM)
      • IAM Structure
      • Roles & Policies
      • Service Accounts
    • Challenges with IA

      • Over permissioning abuse

    MODULE 5.2: Log Sources, Collection & Log Routing

    • GCP Log Explorer
    • Log Explorer Queries
    • Log Routing
    • Log Storage
    • Logging Pipelines
    • Logging Exporting

    MODULE 5.3: VM & Storage Investigations

    • Compute Overview
    • VM Snapshots
    • Google Logging Agent
    • Logging Agent in GCP
    • GCP Storage Buckets
    • Exfil tracking with Billing

    MODULE 5.4: GCP Network Forensics

    • GCP Network DFIR Services Overview
    • GCP VPC Overview
    • VPC Networking
    • VPC Flow Logs
    • Firewall Rules & Logging
    • GCP Packet Mirroring

    MODULE 5.5: Kubernetes Forensics and IR

    • What is Kubernetes
    • Kubernetes Architecture Overview
    • Logs from Kubernetes
    • Kubernetes Across all Clouds
    • Kubernetes Logging for AKS, EKS, and GKS
    • Attacks on Kubernetes
    • Attacks on Cloud-based Kubernetes
    • Kubernetes Case Study

  • Overview

    In the final section, students will split into teams to solve an intrusion that spans all three major cloud providers. Students will need to refer to all their new knowledge for the week and divide and conquer the evidence to find out how the intrusion occurred. Multiple interconnected cloud systems will be examined as students work to determine what happened.

    Students will then present their findings to the class to determine which team will be deemed FOR509 Lethal Forensicators!

GIAC Cloud Forensics Responder

The GCFR certification validates a practitioner’s ability to track and respond to incidents across the three major cloud providers. GCFR-certified professionals are well-versed in the log collection and interpretation skills needed to manage rapidly changing enterprise cloud environments.

  • Log generation, collection, storage and retention in cloud environments
  • Identification of malicious and anomalous activity that affect cloud resources
  • Extraction of data from cloud environments for forensic investigations
More Certification Details

Prerequisites

FOR509 is an Intermediate to Advanced course that focuses on Cloud infrastructure and log analysis. This class teaches students how to make use of cloud provider created data that augments, replaces or extends the artifacts they already learned about in prior SANS classes.

Students may benefit from having taken

or having relevant previous experience.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.

MANDATORY FOR509 SYSTEM HARDWARE REQUIREMENTS:

  • CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
  • CRITICAL NOTE: Apple systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VT". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!
  • 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
  • USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
  • 350 Gigabytes of Free Space - Note that about 150 GB is required for downloaded evidence files. This data can be stored on an external drive
  • Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • Wireless 802.11 Capability

MANDATORY FOR509 HOST OPERATING SYSTEM REQUIREMENTS:

  • Host Operating System: Latest version of Windows 10 or macOS 10.15.x
  • Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.

PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:

  1. Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
  2. Download and install 7Zip (for Windows Hosts) or Keka (macOS).

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Author Statement

"Many DFIR professionals have dismissed the cloud as 'someone else's computer' missing the wealth of new evidence sources and possibilities that now exist. From audit logs that attackers can't clear without full tenant compromise to the ability to turn on Netflow data with a single line of code/click and no additional hardware needed the cloud offers a world of new possibilities to those DFIR professionals who embrace what the cloud brings to them.

FOR509 was written to give you a headstart in understanding, analyzing and solving cloud based investigations. Not only do we cover the most popular cloud solutions on the market we also help the student to understand now just how to interpret the data but how they can take their detection and response capabilities to the next level. Cloud automation, flexible infrastructure on demand and entire processing clusters on standby mean you can make your enterprise ready for an event at any scale. We've dealt with some of the biggest breaches in some of the biggest networks and we'll show students how they can be ready to do the same in the cloud."

- David Cowen

"Just as we got better at defending our on-premise environment, the shiny new object called the "cloud" has radically changed our battlefield. Corporations are moving their systems and data to the cloud at breakneck speed, leaving us as their defenders scrambling for new playbooks and know-how to keep them safe. Lacking direct access to the physical systems means that many traditional forensic methods no longer work. The good news is that we now have cloud specific tools and logs that empowers us to respond to incidents faster and better. FOR509 will examine these tools and techniques to take your skills to the cloud level."

- Pierre Lidome

"Organizations are rapidly moving to cloud environments and this trend is only going to continue. Unfortunately, the incident responders and digital forensics professionals who previously worked in traditional, on-premise environments are left to get up to speed on these new technologies. FOR509 provides defenders and responders with the knowledge and skills needed to continue defending their organizations against threats even in this new environment. Learning how to obtain, analyze, and interpret cloud evidence is pivotal to ensuring DFIR professionals are equipped for this rapid cloud migration."

- Megan Roddie

"As organisations rush to find quicker and more flexible ways to build their IT infrastructure and online applications, they leave behind their on-premises infrastructure and the visibility their incident response and digital forensics teams have built over many years. On top of this, new Cloud features and services are being introduced at a rapid pace making it challenging for incident response professions to know what evidence they have available in the event of a cybersecurity incident. The FOR509 class will give both incident response and digital forensics professionals the knowledge and skills they need to know what evidence is available to them, how they can obtain and interpret evidence for the three commonly used IaaS Clouds and common SaaS Clouds. If you or your organisation work with Cloud infrastructure, then this class is "a must" to get an advantage over threat actors!"

- Josh Lemon

Reviews

FOR509 was absolutely awesome! The depth of knowledge is unparalleled. I see this becoming a very popular class in the future.
Terrie Myerchin
AT&T
Thanks a lot for FOR509 course. I believe this course provides a great way to get a really compressed introduction into the different cloud service providers and what is forensically possible there.
Marc Stroebel
HvS-Consulting AG
FOR509 is very much needed in the industry as there is very little training out there for Cloud DFIR. So the fact that this course exists and is huge.
Chester Le Bron Jr
Northwestern Mutual

    Register for FOR509

    Loading...