aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time 2026-06-01T00:00:00Z \
  --end-time 2026-06-30T23:59:59Z \
  --max-results 10

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDAEXAMPLEID12345678",
    "arn": "arn:aws:iam::123456789012:user/analyst",
    "accountId": "123456789012",
    "userName": "analyst",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "sessionContext": {
      "sessionIssuer": {},
      "webIdFederationData": {},
      "attributes": {
        "creationDate": "2026-06-15T08:30:00Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-06-28T14:23:45Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "ListBucket",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.50",
  "userAgent": "aws-cli/2.15.0 Python/3.12.0",
  "requestParameters": {
    "bucketName": "sensitive-data-bucket",
    "max-keys": 1000
  },
  "responseElements": {
    "contents": []
  },
  "requestID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "eventID": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "serviceEventDetails": {},
  "sharedEventId": "",
  "vpcEndpointId": "vpce-0a1b2c3d4e5f67890"
}

aws cloudtrail put-event-selectors \
  --trail-name my-trail \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [{
      "Type": "AWS::S3::Object",
      "Values": ["arn:aws:s3:::sensitive-bucket/"]
    }]
  }]'

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=DescribeInstances \
  --max-results 5

aws cloudtrail describe-trails \
  --trail-list '[{"Name":"my-trail"}]' \
  --query 'trailList[].InsightsSelectors'

{
  "insightDetails": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "RunInstances",
    "insightType": "ApiCallRateInsight",
    "insightEventData": {
      "baseline": {
        "averageEventCount": 15
      },
      "insight": {
        "averageEventCount": 250
      },
      "insightStart": "2026-06-28T00:00:00Z",
      "insightEnd": "2026-06-28T06:00:00Z"
    }
  }
}

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccessKey \
  --max-results 20

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy \
  --max-results 20

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion \
  --max-results 20

aws cloudtrail lookup-events \
  --start-time 2026-06-28T02:00:00Z \
  --end-time 2026-06-28T05:00:00Z \
  --max-results 50 \
  --query 'Events[].{Time:EventTime,User:Username,Event:EventName,Source:EventSource}'

aws cloudtrail lookup-events \
  --start-time 2026-06-28T00:00:00Z \
  --end-time 2026-06-30T23:59:59Z \
  --max-results 100 \
  --query 'Events[?awsRegion != `us-east-1`].{Time:EventTime,Region:awsRegion,Event:EventName,Source:IPAddress}'

CREATE EXTERNAL TABLE cloudtrail_logs (
  eventVersion STRING,
  userIdentity STRUCT<
    type: STRING,
    principalId: STRING,
    arn: STRING,
    accountId: STRING,
    userName: STRING>,
  eventTime STRING,
  eventSource STRING,
  eventName STRING,
  awsRegion STRING,
  sourceIPAddress STRING,
  userAgent STRING,
  requestParameters STRING,
  responseElements STRING,
  additionalEventData STRING,
  requestId STRING,
  eventId STRING,
  readOnly STRING,
  eventType STRING,
  recipientAccountId STRING,
  vpcEndpointId STRING,
  sharedEventId STRING
)
PARTITIONED BY (region STRING, year STRING, month STRING, day STRING)
ROW FORMAT SERDE 'org.apache.hive.hcatalog.data.JsonSerDe'
LOCATION 's3://my-cloudtrail-bucket/AWSLogs/123456789012/CloudTrail/';

SELECT eventTime, userIdentity.userName, eventName, sourceIPAddress, requestParameters
FROM cloudtrail_logs
WHERE eventName IN ('CreateAccessKey', 'AttachUserPolicy', 'CreateLoginProfile', 'UpdateAssumeRolePolicy')
  AND sourceIPAddress NOT IN ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16')
  AND year = '2026' AND month = '06' AND day = '28'
ORDER BY eventTime DESC;

SELECT sourceIPAddress, userIdentity.arn, eventName, COUNT(*) as callCount
FROM cloudtrail_logs
WHERE eventName LIKE '%Describe%' OR eventName LIKE '%List%'
  AND year = '2026' AND month = '06' AND day = '28'
GROUP BY sourceIPAddress, userIdentity.arn, eventName
HAVING COUNT(*) > 100
ORDER BY callCount DESC;

Get-AzActivityLog -ResourceGroup "myRG" -MaxRecordCount 10 | Format-Table EventTimestamp, OperationName, Caller, Status

{
  "channels": "Operation",
  "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "eventTimestamp": "2026-06-28T14:23:45.1234567Z",
  "level": "Informational",
  "location": "eastus",
  "operationName": {
    "value": "Microsoft.Authorization/roleAssignments/write",
    "localizedValue": "创建或更新角色分配"
  },
  "resourceGroupName": "production-rg",
  "resourceProviderName": {
    "value": "Microsoft.Authorization",
    "localizedValue": "Azure Authorization"
  },
  "resourceType": {
    "value": "Microsoft.Authorization/roleAssignments",
    "localizedValue": "角色分配"
  },
  "status": {
    "value": "Succeeded",
    "localizedValue": "成功"
  },
  "subStatus": {
    "value": "",
    "localizedValue": ""
  },
  "caller": "admin@contoso.com",
  "claims": {
    "name": "admin@contoso.com",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
    "http://schemas.microsoft.com/claims/authmethodsincludes": "pwd"
  },
  "httpRequest": {
    "clientRequestId": "req-a1b2c3d4",
    "clientIpAddress": "203.0.113.50",
    "method": "PUT",
    "url": "https://management.azure.com/subscriptions/xxx/providers/Microsoft.Authorization/roleAssignments/xxx"
  }
}

AzureActivity
| where TimeGenerated > ago(24h)
| where Category == "Administrative"
| where OperationNameValue has_any ("roleAssignments/write", "roleAssignments/delete", "deployments/write")
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, Status, HTTPRequest
| order by TimeGenerated desc

AzureActivity
| where TimeGenerated > ago(7d)
| where Category == "Administrative"
| where OperationNameValue has "roleAssignments"
| extend ParsedClaims = parse_json(Claims)
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, Properties
| order by TimeGenerated desc

AzureActivity
| where TimeGenerated > ago(24h)
| where Category == "Administrative"
| extend Hour = hourofday(TimeGenerated)
| where Hour < 6 or Hour > 22
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, Properties
| order by TimeGenerated desc

AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue has_any (
    "Microsoft.Authorization/roleAssignments/write",
    "Microsoft.Authorization/roleAssignments/delete",
    "Microsoft.Authorization/roleDefinitions/write",
    "Microsoft.Authorization/policyAssignments/write"
  )
| summarize Count = count() by Caller, bin(TimeGenerated, 1h)
| where Count > 5
| order by TimeGenerated desc

AzureActivity
| where TimeGenerated > ago(24h)
| where Category == "Administrative"
| where OperationNameValue has "write" or OperationNameValue has "create"
| where ResourceProviderValue has_any ("Microsoft.Compute", "Microsoft.Network", "Microsoft.Storage")
| summarize Count = count() by Caller, ResourceProviderValue, bin(TimeGenerated, 1h)
| order by Count desc

az monitor activity-log list \
  --query "[?category=='Administrative'].{Time:eventTimestamp,Caller:caller,Operation:operationName.value,Resource:resourceGroupName,Status:status.value}" \
  --output table \
  --start-time 2026-06-28T00:00:00Z \
  --end-time 2026-06-28T23:59:59Z \
  --max-events 100

az rest --method get \
  --uri "https://graph.microsoft.com/v1.0/auditLogs/directories" \
  --query "value[?activityDisplayName=='Add member to role'].{Time:activityDateTime,Initiator:initiatedBy.user.userPrincipalName,Target:targetResources[0].displayName,Role:targetResources[2].displayName}"

Get-AzActivityLog -ResourceGroup "production-rg" -StartTime (Get-Date).AddDays(-7) -MaxRecordCount 200 |
  Where-Object { $_.Category -eq "Administrative" } |
  Select-Object EventTimestamp, Caller, OperationName, Status |
  Sort-Object EventTimestamp -Descending |
  Format-Table -AutoSize

{
  "auditConfigs": [
    {
      "service": "allServices",
      "auditLogConfigs": [
        {
          "logType": "ADMIN_READ"
        },
        {
          "logType": "DATA_READ"
        },
        {
          "logType": "DATA_WRITE"
        }
      ]
    }
  ]
}

gcloud logging read 'resource.type="gce_instance" AND protoPayload.authenticationInfo.principalEmail!=""' \
  --freshness=24h \
  --limit=50 \
  --format=json

gcloud logging read 'protoPayload.methodName="SetIamPolicy" AND protoPayload.resourceName="projects/my-project/serviceAccounts/123456789@my-project.iam.gserviceaccount.com"' \
  --freshness=7d \
  --format=json

gcloud logging read 'protoPayload.methodName="storage.setIamPermissions" AND resource.type="gcs_bucket"' \
  --freshness=30d \
  --format=json

gcloud logging read '
  protoPayload.methodName!="" AND
  protoPayload.authenticationInfo.principalEmail!="" AND
  timestamp>="2026-06-28T00:00:00Z" AND
  timestamp<="2026-06-28T23:59:59Z"
' --format=json --limit=100 > audit_logs.json

SELECT
  timestamp,
  protopayload_auditlog.authenticationInfo.principalEmail AS caller,
  protopayload_auditlog.methodName AS method,
  protopayload_auditlog.resourceName AS resource,
  protopayload_auditlog.status.message AS error_msg,
  protopayload_auditlog.requestMetadata.callerIp AS source_ip,
  protopayload_auditlog.servicename AS service
FROM `my-project.cloudaudit.googleapis.com_activity_20260628`
WHERE protopayload_auditlog.methodName LIKE '%SetIamPolicy%'
  OR protopayload_auditlog.methodName LIKE '%Create%ServiceAccount%'
  OR protopayload_auditlog.methodName LIKE '%Delete%Bucket%'
ORDER BY timestamp DESC;

gcloud logging read '
  protoPayload.authenticationInfo.serviceAccountDelegationInfo!="" AND
  protoPayload.authenticationInfo.principalEmail!="" AND
  timestamp>="2026-06-28T00:00:00Z"
' --format=json | \
  jq '[.[] | {time: .timestamp, caller: .protoPayload.authenticationInfo.principalEmail, method: .protoPayload.methodName, source: .protoPayload.requestMetadata.callerIp}]'

gcloud logging read '
  resource.labels.region!="" AND
  resource.labels.region!="us-central1" AND
  timestamp>="2026-06-28T00:00:00Z" AND
  protoPayload.authenticationInfo.principalEmail="attacker@external.com"
' --format=json --limit=100

gcloud logging read '
  resource.type="kms_crypto_key" OR resource.type="kms_key_ring" OR
  (protoPayload.serviceName="cloudkms.googleapis.com")
' --freshness=24h --format=json | \
  jq '.[] | select(.protoPayload.methodName | test("Decrypt|Encrypt|CreateCryptoKey|DestroyCryptoKey"))'

aws s3api list-object-versions \
  --bucket target-bucket \
  --prefix "confidential/" \
  --max-items 100

aws s3api get-bucket-logging --bucket target-bucket
aws logs filter-log-events \
  --log-group-name "aws-s3-access-logs" \
  --filter-pattern "target-bucket confidential" \
  --start-time 1751126400000

aws s3api put-object-retention \
  --bucket evidence-bucket \
  --key "incident-evidence-2026-06-28.json" \
  --retention '{"Mode":"COMPLIANCE","RetainUntilDate":"2027-06-28T00:00:00Z"}'

#!/bin/bash
BUCKET=$1
echo "[+] Enumerating bucket: $BUCKET"
aws s3api get-bucket-acl --bucket $BUCKET
aws s3api get-bucket-policy --bucket $BUCKET 2>/dev/null
aws s3api get-bucket-versioning --bucket $BUCKET
aws s3api get-bucket-logging --bucket $BUCKET
aws s3api get-bucket-encryption --bucket $BUCKET
aws s3api get-public-access-block --bucket $BUCKET 2>/dev/null
echo "[+] Listing objects..."
aws s3 ls s3://$BUCKET --recursive --summarize
echo "[+] Checking object versions..."
aws s3api list-object-versions --bucket $BUCKET --max-items 50
echo "[+] Downloading access logs..."
aws s3api get-bucket-location --bucket $BUCKET

Get-AzStorageBlob -Container "sensitive-data" -Context $ctx |
  Select-Object Name, Length, LastModified, SnapshotTime, BlobType |
  Sort-Object LastModified -Descending |
  Format-Table -AutoSize

New-AzStorageBlobSnapshot -Container "evidence" -Blob "incident-data.json" -Context $ctx

Get-AzStorageBlobServiceProperty -Context $ctx -StorageAccountName "forensicsa"
Enable-AzStorageBlobDeleteRetentionPolicy -Context $ctx -Enable $true -DaysRetention 365

AzureActivity
| where TimeGenerated > ago(30d)
| where ResourceProviderValue == "Microsoft.Storage"
| where OperationNameValue has_any ("write", "delete", "read")
| project TimeGenerated, Caller, OperationNameValue, Resource, Properties
| order by TimeGenerated desc

gsutil ls -la gs://target-bucket/confidential/
gsutil ls -ael gs://target-bucket/confidential/

gsutil iam get gs://target-bucket
gsutil iam get gs://target-bucket/confidential/sensitive-data.pdf

gsutil logging get gs://target-bucket
gsutil logging set on gs://target-bucket gs://logging-bucket

gcloud logging read '
  resource.type="gcs_bucket" AND
  (protoPayload.methodName="storage.objects.get" OR
   protoPayload.methodName="storage.objects.list" OR
   protoPayload.methodName="storage.objects.delete")
' --freshness=30d --format=json

aws s3api get-bucket-policy --bucket target-bucket | jq -r '.Policy' | jq .

gsutil iam get gs://target-bucket | jq .

az storage container show-permission \
  --name sensitive-data \
  --account-name forensicsa \
  --output json

aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-123456789012 \
  --filter '{"contains": {"field": "resource", "value": "arn:aws:s3:::sensitive-bucket"}}'

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=iam.amazonaws.com \
  --start-time 2026-06-01T00:00:00Z \
  --end-time 2026-06-30T23:59:59Z \
  --max-results 100 \
  --query 'Events[].{Time:EventTime,Event:EventName,User:Username,Params:requestParameters}'

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy \
  --start-time 2026-06-28T00:00:00Z \
  --max-results 50

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=PutUserPolicy \
  --start-time 2026-06-28T00:00:00Z \
  --max-results 50

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreatePolicyVersion \
  --start-time 2026-06-28T00:00:00Z \
  --max-results 50

az rest --method get \
  --uri "https://graph.microsoft.com/v1.0/auditLogs/directories?\$filter=activityDisplayName eq 'Add member to role'&\$top=50" \
  --query "value[].{Time:activityDateTime,Initiator:initiatedBy.user.userPrincipalName,Target:targetResources[0].displayName}"

az rest --method get \
  --uri "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=status/errorCode ne 0&\$top=50" \
  --query "value[].{Time:createdDateTime,User:userPrincipalName,IP:ipAddress,Status:status.errorCode,Location:location.city}"

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| extend IsRisk = RiskLevelDuringSignIn != "none"
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, IsRisk, RiskLevelDuringSignIn
| order by TimeGenerated desc

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| extend Location = strcat(LocationDetails.city, ", ", LocationDetails.countryOrRegion)
| summarize Locations = make_set(Location), Times = make_set(TimeGenerated) by UserPrincipalName
| extend LocationCount = array_length(Locations)
| where LocationCount > 2
| project UserPrincipalName, Locations, Times, LocationCount

gcloud logging read '
  protoPayload.methodName="SetIamPolicy" OR
  protoPayload.methodName="TestIamPermissions"
' --freshness=30d --format=json | \
  jq '[.[] | {time: .timestamp, caller: .protoPayload.authenticationInfo.principalEmail, method: .protoPayload.methodName, resource: .protoPayload.resourceName}]'

gcloud logging read '
  protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey" OR
  protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount"
' --freshness=30d --format=json

import boto3
import json
from datetime import datetime, timedelta

ct_client = boto3.client('cloudtrail')

HIGH_RISK_EVENTS = [
    'AttachUserPolicy', 'AttachRolePolicy', 'AttachGroupPolicy',
    'PutUserPolicy', 'PutRolePolicy', 'PutGroupPolicy',
    'CreatePolicyVersion', 'SetDefaultPolicyVersion',
    'CreateAccessKey', 'CreateLoginProfile',
    'UpdateLoginProfile', 'AddUserToGroup',
    'AssumeRole', 'AssumeRoleWithSAML'
]

start_time = (datetime.utcnow() - timedelta(days=7)).isoformat() + 'Z'

for event_name in HIGH_RISK_EVENTS:
    response = ct_client.lookup_events(
        LookupAttributes=[
            {'AttributeKey': 'EventName', 'AttributeValue': event_name}
        ],
        StartTime=start_time,
        MaxResults=20
    )
    for event in response['Events']:
        detail = json.loads(event['CloudTrailEvent'])
        print(json.dumps({
            'time': detail.get('eventTime'),
            'event': event_name,
            'user': detail.get('userIdentity', {}).get('userName', 'Unknown'),
            'source_ip': detail.get('sourceIPAddress'),
            'parameters': detail.get('requestParameters')
        }, indent=2))

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAIOSFODNN7EXAMPLE \
  --start-time 2026-06-01T00:00:00Z \
  --max-results 50 \
  --query 'Events[].{Time:EventTime,Event:EventName,Source:IPAddress,User:Username}'

AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any ("Add application", "Add OAuth2PermissionGrant", "Update application", "Add secret")
| project TimeGenerated, OperationName, InitiatedBy=InitiatedBy.user.userPrincipalName, TargetResources
| order by TimeGenerated desc

gcloud logging read '
  protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"
' --freshness=30d --format=json | \
  jq '.[] | {time: .timestamp, caller: .protoPayload.authenticationInfo.principalEmail, key_id: .protoPayload.response.name}'

aws logs describe-log-groups \
  --log-group-name-prefix "/aws/ecs/" \
  --query 'logGroups[].logGroupName'

aws logs filter-log-events \
  --log-group-name "/aws/ecs/web-app" \
  --filter-pattern "ERROR" \
  --start-time 1751126400000 \
  --max-results 100

aws logs filter-log-events \
  --log-group-name "/aws/eks/production-cluster/cluster" \
  --filter-pattern '{ $.objectRef.resource = "pods" && $.verb = "create" }' \
  --start-time 1751126400000

aws logs filter-log-events \
  --log-group-name "vpc-flow-logs" \
  --filter-pattern '{ $.dstPort = 443 && $.action = "ACCEPT" }' \
  --start-time 1751126400000

#!/bin/bash
CLUSTER=$1
echo "[+] Collecting EKS cluster info..."
kubectl cluster-info
kubectl get nodes -o wide
kubectl get pods --all-namespaces -o wide
kubectl get services --all-namespaces
kubectl get rolebindings --all-namespaces
kubectl get clusterrolebindings
echo "[+] Checking for suspicious pods..."
kubectl get pods --all-namespaces -o json | \
  jq '.items[] | select(.spec.containers[].securityContext.privileged == true) | {name: .metadata.name, namespace: .metadata.namespace}'
echo "[+] Collecting pod logs..."
for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}'); do
  for pod in $(kubectl get pods -n $ns -o jsonpath='{.items[*].metadata.name}'); do
    kubectl logs -n $ns $pod --all-containers --tail=1000 > "/tmp/eks-logs/${ns}-${pod}.log" 2>/dev/null
  done
done

az aks show --resource-group myRG --name myAKS --query "monitoring.addonProfile.logs.enabled"
az monitor log-analytics query \
  --workspace "my-workspace-id" \
  --analytics-query "ContainerLog | where TimeGenerated > ago(24h) | where PodName has 'suspicious'" \
  --output table

az monitor log-analytics query \
  --workspace "my-workspace-id" \
  --analytics-query "KubeAuditEvents | where TimeGenerated > ago(24h) | where Verb == 'create' or Verb == 'update'" \
  --output table

AzureActivity
| where TimeGenerated > ago(24h)
| where ResourceProviderValue == "Microsoft.ContainerService"
| where OperationNameValue has_any ("write", "delete")
| project TimeGenerated, Caller, OperationNameValue, Resource, Status
| order by TimeGenerated desc

gcloud logging read '
  resource.type="k8s_cluster" AND
  jsonPayload.kind="Event" AND
  jsonPayload.verdict="create"
' --freshness=24h --format=json

gcloud logging read '
  protoPayload.serviceName="k8s.io" AND
  (protoPayload.methodName="io.k8s.core.v1.pods.create" OR
   protoPayload.methodName="io.k8s.core.v1.secrets.get")
' --freshness=7d --format=json

gcloud logging read '
  resource.type="gce_instance" AND
  labels."k8s.io/cluster-name"="production-cluster" AND
  jsonPayload.message="container Created"
' --freshness=24h --format=json

docker history suspicious-image:latest --no-trunc
docker inspect suspicious-image:latest | jq '.[0].Config'

dive suspicious-image:latest

docker inspect <container_id> | jq '{
  Image: .Config.Image,
  Cmd: .Config.Cmd,
  Entrypoint: .Config.Entrypoint,
  Env: .Config.Env,
  Volumes: .Config.Volumes,
  WorkingDir: .Config.WorkingDir,
  Labels: .Config.Labels,
  NetworkMode: .HostConfig.NetworkMode,
  Privileged: .HostConfig.Privileged,
  CapAdd: .HostConfig.CapAdd,
  CapDrop: .HostConfig.CapDrop
}'

grep -r "docker.sock\|containerd.sock\|proc/1/ns" /var/log/syslog
journalctl -u docker --since "24 hours ago" | grep -i "error\|warn\|escape"

cat /proc/<pid>/status | grep Cap
capsh --decode=<hex_value>

lsns -t user
lsns -t pid

cat /proc/1/cgroup | grep -v docker
grep -r "docker\|kubepods" /proc/*/cgroup 2>/dev/null

aws logs describe-log-groups \
  --log-group-name-prefix "/aws/lambda/" \
  --query 'logGroups[].logGroupName'

aws logs filter-log-events \
  --log-group-name "/aws/lambda/data-processor" \
  --filter-pattern "ERROR" \
  --start-time 1751126400000

aws lambda get-function-configuration \
  --function-name data-processor \
  --query '{Role:Role,Runtime:Runtime,Handler:Handler,Timeout:Timeout,MemorySize:MemorySize,Environment:Environment,VPCConfig:VPCConfig}'

aws xray get-trace-summaries \
  --start-time 2026-06-28T00:00:00Z \
  --end-time 2026-06-28T23:59:59Z \
  --filter-expression 'fault = true'

{
  "Records": [
    {
      "eventVersion": "2.1",
      "eventSource": "aws:s3",
      "awsRegion": "us-east-1",
      "eventTime": "2026-06-28T14:23:45.000Z",
      "eventName": "ObjectCreated:Put",
      "s3": {
        "bucket": {
          "name": "payload-bucket"
        },
        "object": {
          "key": "shell.sh",
          "size": 1024
        }
      }
    }
  ]
}

Get-AzOperationalInsightsQueryWorkspaceDataContent `
  -WorkspaceId "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.OperationalInsights/workspaces/xxx" `
  -Query "requests | where timestamp > ago(24h) | where success == false | project timestamp, name, resultCode, duration"

AppTraces
| where TimeGenerated > ago(24h)
| where OperationName == "data-processor"
| where Level == "Error" or Level == "Warning"
| project TimeGenerated, Message, OperationName, Properties
| order by TimeGenerated desc

az functionapp config appsettings list \
  --name myFunctionApp \
  --resource-group myRG \
  --query "[?contains(name, 'ConnectionString') || contains(name, 'Secret') || contains(name, 'Key')]"

gcloud logging read '
  resource.type="cloud_function" AND
  resource.labels.function_name="data-processor"
' --freshness=24h --format=json

gcloud functions describe data-processor \
  --region=us-central1 \
  --format=json | \
  jq '{
    runtime: .runtime,
    entryPoint: .entryPoint,
    timeout: .timeout,
    availableMemoryMb: .availableMemoryMb,
    serviceAccountEmail: .serviceAccountEmail,
    environmentVariables: .environmentVariables,
    eventTrigger: .eventTrigger
  }'

gcloud logging read '
  protoPayload.serviceName="cloudfunctions.googleapis.com"
' --freshness=24h --format=json | \
  jq '.[] | {time: .timestamp, method: .protoPayload.methodName, caller: .protoPayload.authenticationInfo.principalEmail}'

aws lambda get-function-configuration \
  --function-name compromised-function \
  --query 'Environment.Variables'

aws lambda get-function \
  --function-name compromised-function \
  --query 'Code.Location'

FUNCTION_URL=$(aws lambda get-function --function-name compromised-function --query 'Code.Location' --output text)
curl -o function-code.zip "$FUNCTION_URL"
unzip function-code.zip -d ./function-code/

aws lambda list-versions-by-function \
  --function-name compromised-function \
  --query 'Versions[?Version != `$LATEST`].{Version:Version,CodeSha256:CodeSha256,Created:LastModified}'

{
  "evidence_type": "confirmation",
  "event": "CreateAccessKey",
  "actor": "attacker@external.com",
  "source_ip": "198.51.100.25",
  "target": "arn:aws:iam::123456789012:user/admin",
  "timestamp": "2026-06-28T14:23:45Z",
  "context": "从已知恶意 IP 为高权限用户创建访问密钥",
  "confidence": 0.95
}

{
  "evidence_type": "high_suspicion",
  "event": "ConsoleLogin",
  "actor": "admin@contoso.com",
  "source_ip": "198.51.100.25",
  "location": "Moscow, Russia",
  "timestamp": "2026-06-28T03:15:00Z",
  "context": "从新地理位置在非工作时间登录管理员账户",
  "confidence": 0.75
}

{
  "evidence_type": "attention",
  "event": "AuthorizeSecurityGroupIngress",
  "actor": "developer@contoso.com",
  "source_ip": "10.0.1.50",
  "timestamp": "2026-06-28T10:30:00Z",
  "context": "添加了一条允许 0.0.0.0/0 访问 22 端口的安全组规则",
  "confidence": 0.50
}

aws iam get-role-policy --role-name WAFRole --policy-name S3Access
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/WAFRole \
  --action-names s3:GetObject,s3:ListBucket \
  --resource-arns 'arn:aws:s3:::*' 'arn:aws:s3:::*/*'

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ListBucket \
  --start-time 2019-07-17T00:00:00Z \
  --end-time 2019-07-17T23:59:59Z \
  --max-results 100 \
  --query 'Events[].{Time:EventTime,Source:IPAddress,Params:requestParameters}'

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject \
  --start-time 2019-07-17T00:00:00Z \
  --end-time 2019-07-26T23:59:59Z \
  --max-results 100

SigninLogs
| where TimeGenerated between(datetime(2026-01-15) .. datetime(2026-01-25))
| where UserPrincipalName in ("victim1@contoso.com", "victim2@contoso.com")
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, Location=LocationDetails.city, 
          ClientAppUsed, Browser, OS
| order by TimeGenerated asc

OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation == "New-InboxRule" or Operation == "Set-InboxRule"
| where MailboxUpn in ("victim1@contoso.com", "victim2@contoso.com")
| project TimeGenerated, UserPrincipalName, Operation, MailboxUpn, 
          Parameters=parse_json(Parameters)
| order by TimeGenerated desc

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName == "Consent to application"
| project TimeGenerated, InitiatedBy=initiatedBy.user.userPrincipalName, 
          TargetResources=targetResources[0].displayName, Result
| order by TimeGenerated desc

gcloud logging read '
  protoPayload.serviceName="k8s.io" AND
  jsonPayload.user.username="system:anonymous"
' --freshness=90d --format=json | \
  jq '.[] | {time: .timestamp, method: .protoPayload.methodName, resource: .protoPayload.resourceName}'

gcloud logging read '
  protoPayload.methodName="io.k8s.core.v1.pods.create" AND
  timestamp>="2026-05-01T00:00:00Z"
' --freshness=90d --format=json | \
  jq '.[] | {time: .timestamp, caller: .protoPayload.authenticationInfo.principalEmail, 
              pod: .protoPayload.request.spec.containers[0].name, 
              image: .protoPayload.request.spec.containers[0].image}'

gcloud logging read '
  resource.type="k8s_cluster" AND
  jsonPayload.kind="Event" AND
  labels."k8s.io/pod"!="" AND
  jsonPayload.message="Service changed"
' --freshness=30d --format=json

gcloud logging read '
  protoPayload.methodName="io.k8s.core.v1.pods.create" AND
  jsonPayload.request.spec.containers[0].image!~"gcr.io/my-project/"
' --freshness=90d --format=json

#!/bin/bash
echo "[+] AWS CloudTrail 全面取证收集"
echo "[+] 时间范围: $1 到 $2"
START=$1
END=$2

echo "[+] 收集 IAM 事件..."
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=iam.amazonaws.com \
  --start-time "$START" --end-time "$END" --max-results 200 \
  --query 'Events[].CloudTrailEvent' --output text > /tmp/iam_events.json

echo "[+] 收集 S3 事件..."
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=s3.amazonaws.com \
  --start-time "$START" --end-time "$END" --max-results 200 \
  --query 'Events[].CloudTrailEvent' --output text > /tmp/s3_events.json

echo "[+] 收集 EC2 事件..."
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=ec2.amazonaws.com \
  --start-time "$START" --end-time "$END" --max-results 200 \
  --query 'Events[].CloudTrailEvent' --output text > /tmp/ec2_events.json

echo "[+] 检测控制台登录..."
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time "$START" --end-time "$END" --max-results 100 \
  --query 'Events[].CloudTrailEvent' --output text > /tmp/console_logins.json

echo "[+] 检测 Root 用户活动..."
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=root \
  --start-time "$START" --end-time "$END" --max-results 100 \
  --query 'Events[].CloudTrailEvent' --output text > /tmp/root_activity.json

echo "[+] 检测异常 AssumeRole..."
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=AssumeRole \
  --start-time "$START" --end-time "$END" --max-results 100 \
  --query 'Events[].CloudTrailEvent' --output text > /tmp/assume_role.json

echo "[+] 生成汇总报告..."
for f in /tmp/iam_events.json /tmp/s3_events.json /tmp/ec2_events.json; do
  echo "--- $(basename $f) ---"
  cat "$f" | python3 -c "
import sys, json
events = sys.stdin.read().strip().split('\n')
for line in events:
    try:
        e = json.loads(line)
        print(f\"{e.get('eventTime','N/A')} | {e.get('eventName','N/A')} | {e.get('userIdentity',{}).get('userName','N/A')} | {e.get('sourceIPAddress','N/A')}\")
    except:
        pass
" 2>/dev/null
done

import boto3
import json
from datetime import datetime, timedelta

class CloudTrailForensics:
    def __init__(self, region='us-east-1'):
        self.ct = boto3.client('cloudtrail', region_name=region)
        self.iam = boto3.client('iam')
    
    def get_events_by_event_name(self, event_name, hours=24):
        start = (datetime.utcnow() - timedelta(hours=hours)).isoformat() + 'Z'
        events = []
        response = self.ct.lookup_events(
            LookupAttributes=[
                {'AttributeKey': 'EventName', 'AttributeValue': event_name}
            ],
            StartTime=start,
            MaxResults=100
        )
        events.extend(response['Events'])
        while 'NextToken' in response:
            response = self.ct.lookup_events(
                LookupAttributes=[
                    {'AttributeKey': 'EventName', 'AttributeValue': event_name}
                ],
                StartTime=start,
                NextToken=response['NextToken'],
                MaxResults=100
            )
            events.extend(response['Events'])
        return events
    
    def detect_iam_enumeration(self, hours=24):
        enumeration_apis = [
            'ListUsers', 'ListRoles', 'ListPolicies',
            'ListGroups', 'ListAccessKeys', 'GetUser',
            'GetRole', 'GetPolicy', 'GetAccountAuthorizationDetails'
        ]
        findings = []
        for api_name in enumeration_apis:
            events = self.get_events_by_event_name(api_name, hours)
            for event in events:
                detail = json.loads(event['CloudTrailEvent'])
                findings.append({
                    'time': detail.get('eventTime'),
                    'api': api_name,
                    'user': detail.get('userIdentity', {}).get('userName', 'Unknown'),
                    'source_ip': detail.get('sourceIPAddress'),
                    'user_agent': detail.get('userAgent')
                })
        return findings
    
    def detect_suspicious_assume_role(self, hours=24):
        events = self.get_events_by_eventName('AssumeRole', hours) if False else []
        start = (datetime.utcnow() - timedelta(hours=hours)).isoformat() + 'Z'
        response = self.ct.lookup_events(
            LookupAttributes=[
                {'AttributeKey': 'EventName', 'AttributeValue': 'AssumeRole'}
            ],
            StartTime=start,
            MaxResults=100
        )
        events.extend(response['Events'])
        findings = []
        for event in events:
            detail = json.loads(event['CloudTrailEvent'])
            params = detail.get('requestParameters', {})
            findings.append({
                'time': detail.get('eventTime'),
                'role_arn': params.get('roleArn'),
                'session_name': params.get('roleSessionName'),
                'source_ip': detail.get('sourceIPAddress'),
                'user_agent': detail.get('userAgent'),
                'mfa': detail.get('userIdentity', {}).get('sessionContext', {})
                    .get('attributes', {}).get('mfaAuthenticated', 'false')
            })
        return findings
    
    def generate_report(self, hours=24):
        report = {
            'generated_at': datetime.utcnow().isoformat(),
            'time_range_hours': hours,
            'iam_enumeration': self.detect_iam_enumeration(hours),
            'assume_role_events': self.detect_suspicious_assume_role(hours)
        }
        return report

if __name__ == '__main__':
    forensics = CloudTrailForensics()
    report = forensics.generate_report(hours=168)
    print(json.dumps(report, indent=2, default=str))

#!/bin/bash
echo "[+] Azure Activity Log 取证收集"
echo "[+] 订阅: $(az account show --query 'id' -o tsv)"

echo "[+] 收集管理操作..."
az monitor activity-log list \
  --query "[?category=='Administrative'].{Time:eventTimestamp,Caller:caller,Op:operationName.value,Resource:resourceGroupName,Status:status.value}" \
  --output json \
  --start-time "$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
  --max-events 500 > /tmp/azure_admin.json

echo "[+] 收集安全事件..."
az monitor activity-log list \
  --query "[?category=='Security'].{Time:eventTimestamp,Alert:properties.incidentInfo.incidentNumber,Severity:properties.incidentInfo.severity,Status:properties.incidentInfo.resolutionStatus}" \
  --output json \
  --start-time "$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)" > /tmp/azure_security.json

echo "[+] 检测高风险角色变更..."
az monitor activity-log list \
  --query "[?contains(operationName.value, 'roleAssignments')].{Time:eventTimestamp,Caller:caller,Op:operationName.value,Target:properties.targetResources}" \
  --output json \
  --start-time "$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ)" > /tmp/azure_rbac.json

echo "[+] 收集 Azure AD 登录..."
az rest --method get \
  --uri "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$top=100&\$filter=status/errorCode%20ne%200" \
  --output json > /tmp/azure_failed_logins.json

echo "[+] 生成汇总..."
python3 -c "
import json
for fname in ['azure_admin.json', 'azure_security.json', 'azure_rbac.json']:
    with open(f'/tmp/{fname}') as f:
        data = json.load(f)
    print(f'\\n--- {fname}: {len(data)} records ---')
    for item in data[:10]:
        print(item)
"

function Get-AzureForensicsReport {
    param(
        [DateTime]$StartTime = (Get-Date).AddDays(-7),
        [DateTime]$EndTime = (Get-Date)
    )

    $report = @{}

    $report.AdminActivity = Get-AzActivityLog -StartTime $StartTime -EndTime $EndTime -MaxRecordCount 500 |
        Where-Object { $_.Category -eq "Administrative" } |
        Select-Object EventTimestamp, Caller, OperationName, Status, ResourceGroupName, CorrelationId

    $report.SecurityEvents = Get-AzActivityLog -StartTime $StartTime -EndTime $EndTime -MaxRecordCount 200 |
        Where-Object { $_.Category -eq "Security" } |
        Select-Object EventTimestamp, OperationName, Level, ResourceGroupName

    $report.RBACChanges = $report.AdminActivity |
        Where-Object { $_.OperationName.Value -like "*roleAssignments*" }

    $report.NonBusinessHours = $report.AdminActivity |
        Where-Object { $_.EventTimestamp.Hour -lt 6 -or $_.EventTimestamp.Hour -gt 22 }

    $report.ResourceGroupChanges = $report.AdminActivity |
        Group-Object ResourceGroupName |
        Sort-Object Count -Descending |
        Select-Object Name, Count

    $report
}

#!/bin/bash
echo "[+] GCP Audit Log 取证收集"
PROJECT=$(gcloud config get-value project)
echo "[+] 项目: $PROJECT"

echo "[+] 收集 IAM 变更..."
gcloud logging read '
  protoPayload.methodName="SetIamPolicy" OR
  protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey" OR
  protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount"
' --freshness=7d --format=json > /tmp/gcp_iam_changes.json

echo "[+] 收集存储操作..."
gcloud logging read '
  protoPayload.serviceName="storage.googleapis.com" AND
  (protoPayload.methodName="storage.objects.get" OR
   protoPayload.methodName="storage.objects.list" OR
   protoPayload.methodName="storage.objects.delete" OR
   protoPayload.methodName="storage.setIamPermissions")
' --freshness=7d --format=json > /tmp/gcp_storage_ops.json

echo "[+] 收集计算实例操作..."
gcloud logging read '
  protoPayload.serviceName="compute.googleapis.com" AND
  (protoPayload.methodName="compute.instances.insert" OR
   protoPayload.methodName="compute.instances.delete" OR
   protoPayload.methodName="compute.firewalls.insert")
' --freshness=7d --format=json > /tmp/gcp_compute_ops.json

echo "[+] 收集 KMS 操作..."
gcloud logging read '
  protoPayload.serviceName="cloudkms.googleapis.com"
' --freshness=7d --format=json > /tmp/gcp_kms_ops.json

echo "[+] 生成汇总报告..."
python3 -c "
import json
total_events = 0
for fname in ['gcp_iam_changes.json', 'gcp_storage_ops.json', 'gcp_compute_ops.json', 'gcp_kms_ops.json']:
    with open(f'/tmp/{fname}') as f:
        data = json.load(f)
    total_events += len(data)
    print(f'{fname}: {len(data)} events')
    for item in data[:5]:
        ts = item.get('timestamp', 'N/A')
        method = item.get('protoPayload', {}).get('methodName', 'N/A')
        caller = item.get('protoPayload', {}).get('authenticationInfo', {}).get('principalEmail', 'N/A')
        print(f'  {ts} | {method} | {caller}')
print(f'\\nTotal events: {total_events}')
"

title: AWS Root User Activity Detected
id: 3c8e4f2a-1b5d-4e7f-9a8c-2d6e4f8a1b3c
status: stable
description: 检测 AWS 根用户的 API 调用活动，根用户的任何非计划内活动都应视为高优先级事件
references:
  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    userIdentity.type: Root
  selection_source:
    eventSource: ''
  condition: selection_event and not selection_source
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1078.004
falsepositives:
  - 合法的根用户操作（应该极少见）

title: Suspicious AWS AssumeRole From External IP
id: 5d7f2a8b-3c1e-4a6d-9f0e-2b4c6d8a1e3f
status: stable
description: 检测从非组织 IP 地址发起的 AssumeRole 调用，可能表明凭据泄露
references:
  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_get-token.html
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: AssumeRole
    requestParameters.roleArn|contains: ':root'
  filter_legitimate:
    sourceIPAddress|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_legitimate
level: high
tags:
  - attack.credential_access
  - attack.t1550

title: Azure Administrative Operation Outside Business Hours
id: 7a2e4f8c-5d1b-4c9a-8e3f-6a2d4b6c8e1f
status: stable
description: 检测在非工作时间（UTC 22:00-06:00）执行的 Azure 管理操作
references:
  - https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
logsource:
  product: azure
  service: activity-log
detection:
  selection:
    category: Administrative
  timeframe_filter:
    eventTimestamp|hour: 0
  condition: selection and timeframe_filter
level: medium
tags:
  - attack.initial_access
  - attack.t1078.004

title: GCP Service Account Key Created
id: 9e4f2a8b-1c3d-4e5f-6a7b-8c9d0e1f2a3b
status: stable
description: 检测新的 Service Account 密钥创建操作，这可能是凭据持久化的前兆
references:
  - https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
logsource:
  product: gcp
  service: audit-log
detection:
  selection:
    protoPayload.methodName: google.iam.admin.v1.CreateServiceAccountKey
  filter_non_sa:
    protoPayload.authenticationInfo.principalEmail|endswith:
      - '.gserviceaccount.com'
  condition: selection and not filter_non_sa
level: high
tags:
  - attack.credential_access
  - attack.t1098.001

title: AWS S3 Bucket Public Access Modified
id: 2b4d6f8a-0c1e-4a3b-5d7f-9e2a4c6b8d0f
status: stable
description: 检测 S3 存储桶公共访问阻止配置被修改，可能是数据泄露的前兆
references:
  - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName|contains:
      - 'PutBucketPublicAccessBlock'
      - 'PutBucketAcl'
      - 'PutBucketPolicy'
  selection_response:
    requestParameters.PublicAccessBlockConfiguration:
      BlockPublicAcls: false
  condition: selection
level: critical
tags:
  - attack.initial_access
  - attack.t1190