performing-cloud-forensics-with-aws-cloudtrail
Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
Best use case
performing-cloud-forensics-with-aws-cloudtrail is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
Teams using performing-cloud-forensics-with-aws-cloudtrail should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How performing-cloud-forensics-with-aws-cloudtrail Compares
| Feature / Agent | performing-cloud-forensics-with-aws-cloudtrail | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Performing Cloud Forensics with AWS CloudTrail ## When to Use - When investigating suspected AWS account compromise - After detecting unauthorized API calls or credential exposure - During incident response involving cloud infrastructure - When analyzing S3 data exfiltration or IAM privilege escalation - For post-incident forensic timeline reconstruction ## Prerequisites - AWS account with CloudTrail enabled (management and data events) - IAM permissions for cloudtrail:LookupEvents, s3:GetObject, athena:StartQueryExecution - boto3 Python SDK installed - CloudTrail logs delivered to S3 with optional Athena table configured - AWS CLI configured with appropriate credentials ## Workflow 1. **Scope Investigation**: Identify timeframe, affected accounts, and compromised credentials. 2. **Query CloudTrail**: Use boto3 lookup_events or Athena to retrieve relevant API events. 3. **Filter by Indicators**: Search for suspicious user agents, source IPs, and event names. 4. **Reconstruct Timeline**: Build chronological sequence of attacker actions from API calls. 5. **Analyze Access Patterns**: Identify data access, IAM changes, and resource modifications. 6. **Identify Persistence**: Check for new IAM users, access keys, roles, or Lambda functions. 7. **Generate Report**: Produce forensic timeline with findings and remediation steps. ## Key Concepts | Concept | Description | |---------|-------------| | LookupEvents | CloudTrail API to query management events (last 90 days) | | Athena Queries | SQL queries against CloudTrail logs in S3 for historical analysis | | User Agent Analysis | Identify tool signatures (AWS CLI, SDK, console, custom) | | AccessKeyId | Track activity by specific IAM access key | | EventName | AWS API action name (e.g., GetObject, CreateUser, AssumeRole) | | sourceIPAddress | Origin IP of API call for geolocation analysis | ## Tools & Systems | Tool | Purpose | |------|---------| | boto3 CloudTrail client | Programmatic CloudTrail event lookup | | AWS Athena | SQL-based analysis of CloudTrail S3 logs | | AWS CLI | Command-line CloudTrail queries | | jq | JSON processing for CloudTrail event parsing | | CloudTrail Lake | Advanced event data store with SQL query support | ## Output Format ``` Forensic Report: AWS-IR-[DATE]-[SEQ] Account: [AWS Account ID] Timeframe: [Start] to [End] Compromised Credentials: [Access Key IDs] Suspicious Events: [Count] Source IPs: [List of attacker IPs] Actions Taken: [API calls by attacker] Data Accessed: [S3 objects, secrets, etc.] Persistence Mechanisms: [New users, keys, roles] ```
Related Skills
securing-kubernetes-on-cloud
This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for GKE, and Managed Identities for AKS.
performing-yara-rule-development-for-detection
Develop precise YARA rules for malware detection by identifying unique byte patterns, strings, and behavioral indicators in executable files while minimizing false positives.
performing-wireless-security-assessment-with-kismet
Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.
performing-wireless-network-penetration-test
Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.
performing-windows-artifact-analysis-with-eric-zimmerman-tools
Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline Explorer for parsing registry hives, prefetch files, event logs, and file system metadata.
performing-wifi-password-cracking-with-aircrack
Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.
performing-web-cache-poisoning-attack
Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during authorized security tests.
performing-web-cache-deception-attack
Execute web cache deception attacks by exploiting path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve sensitive authenticated content.
performing-web-application-vulnerability-triage
Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and prioritize remediation.
performing-web-application-scanning-with-nikto
Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies ve
performing-web-application-penetration-test
Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.
performing-web-application-firewall-bypass
Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution, and payload obfuscation to deliver SQL injection, XSS, and other attack payloads past WAF detection rules.