pinkpixel-dev/performing-cloud-forensics-with-aws-cloudtrail
SKILLS/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md
Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 performing-cloud-forensics-with-aws-cloudtrailInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 15, 2026, 6:21 AM268.6s3 files scanned
SKILL.md
- name:
- performing-cloud-forensics-with-aws-cloudtrail
- description:
- Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
- domain:
- cybersecurity
- subdomain:
- cloud-security
- tags:
- [cloud-security, aws, cloudtrail, forensics, incident-response, dfir, boto3, s3]
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Performing Cloud Forensics with AWS CloudTrail
When to Use
- When investigating suspected AWS account compromise
- After detecting unauthorized API calls or credential exposure
- During incident response involving cloud infrastructure
- When analyzing S3 data exfiltration or IAM privilege escalation
- For post-incident forensic timeline reconstruction
Prerequisites
- AWS account with CloudTrail enabled (management and data events)
- IAM permissions for cloudtrail:LookupEvents, s3:GetObject, athena:StartQueryExecution
- boto3 Python SDK installed
- CloudTrail logs delivered to S3 with optional Athena table configured
- AWS CLI configured with appropriate credentials
Workflow
- Scope Investigation: Identify timeframe, affected accounts, and compromised credentials.
- Query CloudTrail: Use boto3 lookup_events or Athena to retrieve relevant API events.
- Filter by Indicators: Search for suspicious user agents, source IPs, and event names.
- Reconstruct Timeline: Build chronological sequence of attacker actions from API calls.
- Analyze Access Patterns: Identify data access, IAM changes, and resource modifications.
- Identify Persistence: Check for new IAM users, access keys, roles, or Lambda functions.
- Generate Report: Produce forensic timeline with findings and remediation steps.
Key Concepts
| Concept | Description | |---------|-------------| | LookupEvents | CloudTrail API to query management events (last 90 days) | | Athena Queries | SQL queries against CloudTrail logs in S3 for historical analysis | | User Agent Analysis | Identify tool signatures (AWS CLI, SDK, console, custom) | | AccessKeyId | Track activity by specific IAM access key | | EventName | AWS API action name (e.g., GetObject, CreateUser, AssumeRole) | | sourceIPAddress | Origin IP of API call for geolocation analysis |
Tools & Systems
| Tool | Purpose | |------|---------| | boto3 CloudTrail client | Programmatic CloudTrail event lookup | | AWS Athena | SQL-based analysis of CloudTrail S3 logs | | AWS CLI | Command-line CloudTrail queries | | jq | JSON processing for CloudTrail event parsing | | CloudTrail Lake | Advanced event data store with SQL query support |
Output Format
Forensic Report: AWS-IR-[DATE]-[SEQ]
Account: [AWS Account ID]
Timeframe: [Start] to [End]
Compromised Credentials: [Access Key IDs]
Suspicious Events: [Count]
Source IPs: [List of attacker IPs]
Actions Taken: [API calls by attacker]
Data Accessed: [S3 objects, secrets, etc.]
Persistence Mechanisms: [New users, keys, roles]
Related Skills
pinkpixel-dev/performing-cryptographic-audit-of-application
development
VerifiedTrustedCommunity
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-credential-access-with-lazagne
tools
VerifiedTrustedCommunity
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-content-security-policy-bypass
testing
VerifiedTrustedCommunity
Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-container-security-scanning-with-trivy
testing
VerifiedTrustedCommunity
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
1SKILL.mdUpdated Jul 15, 2026