
Welcome to FOR509: Enterprise Cloud Forensics and Incident Response
Instructor: David Cowen | 24 CPEs
The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner's ability to put their hands directly on the data.
Many examiners are trying to force old methods for on-premise examination onto cloud hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources.
FOR509: Enterprise Cloud Forensics addresses today's need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.
What You Will Learn
Find the Storm in the Cloud
FOR509: Enterprise Cloud Forensics and Incident Response will help you:
- Understand forensic data only available in the cloud
- Implement best practices in cloud logging for DFIR
- Properly handle rapid triage in cloud environments
- Learn how to leverage Microsoft Azure, AWS and Google Cloud Platform resources to gather evidence
- Understand what Microsoft 365 has available for analysts to review
- Learn how to move your forensic process to the cloud for fast processing where the data lives
With Enterprise Cloud Forensics examiners will learn how each of the major cloud service providers (Microsoft Azure, Amazon AWS and Google Cloud Platform) are extending analyst's capabilities with new evidence sources not available in traditional on-premise investigations. From cloud equivalents of network traffic monitoring to direct hypervisor interaction for evidence preservation, forensics is not dead. It is reborn with new technologies and capabilities.
The new world does not end there. More organizations are moving critical resources into the cloud with Microsoft 365. Examiners no longer have direct access to the email servers and datastores for recovering actions; which means they need to learn the new methods available to them to recreate the same data. But why stop at recreation? These new platforms allow us to extend our reach to data we could not easily access before, which when properly configured, can allow for detection and remediation faster than ever before.
The assumption that a change in where or how data is stored always seems to lead to the false assumption that forensics is dead. With the cloud, forensics is given new capabilities and depth that do not exist in the on-premise world. Learn to preserve, configure and examine new sources of evidence that only exist in the Cloud. Learn how to bring your examination into the cloud and how to triage within the same environment. Constantly updated, the Enterprise Cloud Forensics course (FOR509) addresses today's need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments, where their most valuable data is now stored.
Numerous hands-on labs throughout the course will allow examiners to access evidence generated based on the most common incidents and investigations. Examiners will learn where to pull data from and how to analyze it to find evil.
Incident response and forensics are primarily about following breadcrumbs left behind by attackers. These breadcrumbs are mostly found in logs. Your knowledge of the investigation process is far more important than the mechanics of acquiring the logs. As such, the labs will not directly access the cloud as such a requirement would encounter issues with expiring logs, cloud provider changes, and delays in log availability.
Before, during, and after an investigation cloud resources are constantly changing, FOR509: Enterprise Cloud Forensics will train you and your team to turn on the logs you need for the future, work with the data you have today, and prepare to automate for tomorrow.
FOR509 ENTERPRISE CLOUD FORENSICS WILL PREPARE YOUR TEAM TO:
- Learn and master the tools, techniques, and procedures necessary to effectively locate, identify, and collect data no matter where it is located
- Identify and utilize new data only available from Cloud environments
- Quickly parse and filter large data sets, using scalable technologies such as the Elastic Stack
- Learn how to profile attackers in different cloud environments
- Understand what data is available in different cloud environments
FOR509 ENTERPRISE CLOUD FORENSICS COURSE TOPICS
- Cloud Infrastructure and IR data sources
- Microsoft 365 and Graph API
- AWS Incident Response
- Azure Incident Response
- GCP Incident Response
WHAT YOU WILL RECEIVE
- SOF-ELK(R) Virtual Machine - a publicly available appliance running the Elastic Stack and the author's custom set of configurations and lab data. The VM is preconfigured to ingest cloud logs from AWS, Azure, and GCP, and will be used during the class to help students wade through the large number of records they are likely to encounter during a typical investigation.
- Realistic case data to examine during class.
- Exercise book with detailed step-by-step instructions and examples to help you master cloud forensics
WHAT TO TAKE NEXT
- FOR500: Windows Forensic Analysis
- FOR508: Advanced Incident Response, Threat Hunting & Digital Forensics
- FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
- SEC541: Cloud Security Monitoring and Threat Detection
- SEC510: Public Cloud Security: AWS, Azure & GCP
- SEC588: Cloud Penetration Testing
Course Syllabus
FOR509.1: Cloud Forensics Fundamentals and Microsoft 365Mon May 16, 20228:30 AM - 5:00 PM OverviewThere is a universe of data out there to be discovered. Before you can begin exploring the universe of cloud data you must learn where and how it exists. In this section you will learn about the most popular cloud architectures (IaaS, PaaS, SaaS) and how each changes your investigative possibilities. You will understand what kind of logging and data access is provided by each cloud architecture and how to extract and process this data. We will introduce SOF-ELK, an open source SIEM made for enterprise log analysis that easily extends into cloud forensics. We then go into Microsoft 365 which is a SaaS platform that provides the Microsoft Office suite of applications including Excel and Word. In addition, Microsoft 365 implements a number of communications and collaboration tools such as Exchange, SharePoint, and Teams. We finish the day by exploring the Microsoft Graph API and review the logs that it generates. ExercisesLAB 0: Install SOF-ELK VM Prior to the class, students are expected to install the SOF-ELK VM with all the updates including the electronic workbook. LAB 1.1: Visualize data in SOF-ELK In this lab students will learn how to search and visualize data in Kibana. They will also learn how to create their own dashboard. Kibana dashboards allow analysts to display summarized statistics and predefined filters for specific scenarios. LAB 1.2: Find the source of a BEC Students will review Unified Audit Logs in SOF-ELK to find the source of a business email compromise. Utilizing user agents, IP geo location and source IP addresses students will be able to profile and identify hostile agents. LAB 1.3: Tracking Graph API Usage The Graph API is a powerful way to interact with the Microsoft cloud (both Microsoft 365 and Azure). Understanding the permissions granted to a Graph API application is critical to eliminating blindspots and solving incidents. We will explore the logs generated by the Graph API and touch on the lack of logs under certain circumstances. TopicsMODULE 1.1: Key Elements of Cloud for DFIR
MODULE 1.2: Introducing SOF-ELK
MODULE 1.3: Microsoft 365 Unified Audit Log
MODULE 1.4: Microsoft Graph API
|
FOR509.2: Amazon AWSTue May 17, 20229:00 AM - 5:00 PM OverviewNow that we understand what's possible in the Cloud and the new DFIR evidence sources that exist for us, it's time to turn to the market leader in Cloud services. In this section we will explore how AWS can be used for the responder, how to deploy your own analysis system into your region, the new and relevant log sources for your investigation and how to bring it all together in lab scenarios designed to help you quickly solve the most common AWS cases. ExercisesLAB 2.1: Reviewing CloudTrail Logs In this lab students will make use of exported logs from CloudTrail to identify possible account takeovers. Reviewing multiple scenarios of console access and api key access, students will learn how to find and track these attacks. LAB 2.2: Finding Rogue VMs In this lab students will make use of exported CloudTrail logs to locate newly created EC2 instances of different types created by attackers. LAB 2.3: VPC Flow Log Analysis In this lab students will use VPC Flow logs to find evidence of large data exfiltration. As a bonus, students can also attempt to find beacon traffic to define the indicators of compromise. LAB 2.4: S3 Analysis In this lab students will make use of S3 Access logs to find evidence of data exfiltration from S3 buckets. LAB 2.5: Tracking Lateral Movement In this lab students will use multiple log sources in order to follow an incident from initial IAM exposure to data access. TopicsMODULE 2.1: Understanding AWS
MODULE 2.2: Networking, VMs, and Storage
MODULE 2.3: Log sources for IR
MODULE 2.4: Event Drive Response
MODULE 2.5: In-cloud IR
|
FOR509.3: Microsoft AzureWed May 18, 20229:00 AM - 5:00 PM OverviewOne of the most popular cloud providers for large enterprises is the Microsoft Azure cloud. Azure offers an impressive array of services and with that comes numerous data sources for us to explore. In this section we will learn about the various Azure activity and diagnostics logs. Finally, we will find out how to deploy our own analysis tools in the cloud. ExercisesLAB 3.1: Using SOF-ELK with Azure Logs In this lab students will explore the azure index and discover the users and machines of pymtechlabs.com. LAB 3.2: AAD Password Spray In this lab students will gain experience with the Azure Active Directory logs and identify a password spray attack. LAB 3.3: Tracking Resource Creations In this lab students will see an example of virtual machines being created for the purpose of crypto mining. LAB 3.4: Detecting Data Exfiltration In this lab students will track data exfiltration through NSG flow logs and storage logs. TopicsMODULE 3.1: Understanding Azure
MODULE 3.2: Networking, VMs, and Storage
MODULE 3.3: Log sources for IR
MODULE 3.4: Virtual Machine Logs
MODULE 3.5: In-cloud IR
|
FOR509.4: Google Cloud (GCP)Thu May 19. 20229:00 AM - 5:00 PM OverviewGoogle Cloud Platform (GCP) offers many services and fundamentally changes how identity access management is treated compared to AWS and Azure, along with building in a lot of security and evidence items that are extremely useful to an incident response team. Using a combination of the GCP platform, its built-in auditing, agent-based logging, and external log analysis tools like ELK. This section will teach DFIR professionals with limited knowledge of GCP how to conduct investigations into common attacks on GCP. ExercisesLAB 4.1: GCP IAM and Access Tracking Using the GCP Audit Logs, students will learn to profile, analyze, and summarize login sources with Kibana and GCP logs. LAB 4.2: Google VM Logging Agent - Agent Log Analysis Students will learn about the logs produced by GCP's Agent Logs and how to use them for analyzing a compromised system VM within GCP. LAB 4.3: Storage Abuse and Exfil Students will learn about the type of logs available to track GCP Storage Bucket exfiltration, along with additional techniques to track exfiltration when additional auditing logs are not enabled. LAB 4.4: Network Forensics in GCP Students will learn about the networking logs and data available with GCP and how to use this evidence to conduct Network Forensics for a GCP environment. TopicsMODULE 4.1: Understanding GCP
MODULE 4.2: Log Sources, Collection & Log Routing
MODULE 4.3: VM & Storage Investigations
MODULE 4.4: GCP Network Forensics
|
Who Should Attend
- Incident Response Team Members who may need to response to security incidents/intrusions impacting cloud hosted software, infrastructure or platforms and need to know how to detect, investigate, remediate, and recover from compromised systems across the enterprise cloud.
- Threat Hunters who are seeking to understand threats more fully and how to learn from them in order to more effectively hunt threats and counter their tradecraft.
- SOC Analysts looking to better understand alerts, build the skills necessary to triage events, and fully leverage cloud log sources.
- Experienced Digital Forensic Analysts who want to consolidate and enhance their understanding of cloud-based forensics.
- Information Security Professionals who directly support and aid in responding to data breach incidents and intrusions.
- Federal Agents and Law Enforcement Professionals who want to master advanced intrusion investigations and incident response, and expand their investigative skills beyond traditional host-based digital forensics.
- SANS FOR500, FOR508, SEC541, and SEC504 Graduates looking to add cloud-based forensics to their toolbox.
Prerequisites
FOR509 is an Intermediate to Advanced course that focuses on Cloud infrastructure and log analysis. This class teaches students how to make use of cloud provider created data that augments, replaces or extends the artifacts they already learned about in prior SANS classes.
Students may benefit from having taken
- FOR500: Windows Forensic Analysis
- FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
- SEC488: Cloud Security Essentials
or having relevant previous experience.
Lab Requirements
Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.
MANDATORY FOR509 SYSTEM HARDWARE REQUIREMENTS:
- CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
- CRITICAL NOTE: Apple systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
- It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
- BIOS settings must be set to enable virtualization technology, such as "Intel-VT". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!
- 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
- USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
- 350 Gigabytes of Free Space - Note that about 150 GB is required for downloaded evidence files. This data can be stored on an external drive
- Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
- Wireless 802.11 Capability
MANDATORY FOR509 HOST OPERATING SYSTEM REQUIREMENTS:
- Host Operating System: Latest version of Windows 10 or macOS 10.15.x
- Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:
- Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
- Download and install 7Zip (for Windows Hosts) or Keka (macOS).
Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.