Do I need to have cloud CLIs installed to use this?

Yes, this skill requires the AWS CLI, Azure CLI (az), or Google Cloud SDK (gcloud) to be installed and configured with appropriate permissions on your local environment.

Can I customize what events are considered high-risk?

Yes, the skill is highly configurable via YAML, allowing you to define specific high-risk event names, look-back windows, and key-age thresholds.

What kind of output does the forensic investigation produce?

It generates a detailed markdown findings report in your workspace, along with raw JSON evidence files covering IAM states and audit log exports.

Which cloud providers are supported by this skill?

The skill currently supports Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) using their respective CLI tools.

Does it provide mapping to security frameworks?

Yes, the skill automatically maps its findings to relevant MITRE ATT&CK Cloud techniques to help security teams categorize the threat.

Cloud Forensics & Incident Response

Name: Cloud Forensics & Incident Response
Author: jmagly

byjmagly

•

102

•

보안 및 테스팅

Conducts automated forensic investigations across AWS, Azure, and GCP to detect compromises, data exfiltration, and persistence.

This skill automates the complex process of cloud security investigations by interfacing directly with AWS, Azure, and GCP command-line tools. It systematically analyzes audit logs like CloudTrail and Activity Logs, reviews IAM permissions for privilege escalation, inspects storage access patterns, and evaluates network flows for signs of persistence. By mapping findings to MITRE ATT&CK Cloud techniques, it provides security engineers and developers with standardized forensic reports and evidence collection, significantly reducing the time required to respond to potential cloud security incidents.

주요 기능

01Network flow and storage access pattern investigation

02Multi-cloud support for AWS, Azure, and Google Cloud Platform

03102 GitHub stars

04Automated audit log analysis for high-risk management events

05Standardized markdown reporting mapped to MITRE ATT&CK framework

06Comprehensive IAM review to identify stale keys and over-privileged roles

사용 사례

01Performing post-incident investigations after a suspected account compromise

02Investigating suspicious data access patterns in S3, Blob Storage, or GCP Buckets

03Conducting routine security hygiene audits of cloud IAM and logging configurations

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jmagly/aiwg cloud-forensics

For use in Claude.ai and ChatGPT