Cloud Forensics (AWS GuardDuty / CloudTrail / S3)

Triage GuardDuty findings by decompressing .jsonl.gz archives and extracting high-severity exports, principal pivots, and network IOC-focused extracts. This process surfaces high-signal incident indicators from local copies without touching original evidence.

Reconstruct a CloudTrail timeline by decompressing .json.gz files, flattening Records into JSONL, and generating event frequency summaries, error lists, and CSV investigation timelines to track AWS IAM compromise activity.

IMDS credential theft detection involves analyzing AWS CloudTrail and GuardDuty evidence for specific threat patterns indicating stolen instance metadata service credentials. The analysis identifies these signals alongside IAM persistence and S3 exfiltration patterns.

Identify IAM persistence by parsing CloudTrail logs for threat patterns like new access keys and policy changes. The extraction process flags these indicators alongside IMDS credential theft signals and suspicious S3 object access.

You need jq or Python to perform extraction of prioritized findings, timelines, and principal pivots. These tools process the decompressed and flattened JSONL data to generate CSV exports under analysis and export directories.

Detect S3 exfiltration from read-only log artifacts by analyzing GuardDuty and CloudTrail evidence for suspicious GetObject and Delete event patterns. This avoids modifying originals while extracting prioritized findings into investigation timelines.