Scribd
Upload
615 views4 pages

FOR509 - in Class Links

The document provides links to resources for investigating security incidents involving cloud services and platforms: Day 1 lists tools and resources for hunting threats in Azure Active Directory and investigating serverless attacks in cloud platforms. Day 2 focuses on incident response teams and resources for auditing and enabling logging in AWS. Day 3 covers comparing cloud services, capturing volatile memory, and dumping credentials from Azure AD Connect. Day 4 summarizes automation tools for digital forensics, techniques for privilege escalation in GCP, and security tools for Kubernetes environments.

Uploaded by

Jeel Vora
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
615 views4 pages

FOR509 - in Class Links

The document provides links to resources for investigating security incidents involving cloud services and platforms: Day 1 lists tools and resources for hunting threats in Azure Active Directory and investigating serverless attacks in cloud platforms. Day 2 focuses on incident response teams and resources for auditing and enabling logging in AWS. Day 3 covers comparing cloud services, capturing volatile memory, and dumping credentials from Azure AD Connect. Day 4 summarizes automation tools for digital forensics, techniques for privilege escalation in GCP, and security tools for Kubernetes environments.

Uploaded by

Jeel Vora
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 4

Day 1 1

Day 2 2

Day 3 3

Day 4 4

Day 1
Adaz: Active Directory Hunting Lab in Azure
https://github.com/christophetd/Adaz

Turbinia: deploying, managing, and running distributed forensic workloads


https://github.com/google/turbinia

Azure SimuLand
https://www.microsoft.com/security/blog/2021/05/20/simuland-understand-adversary-
tradecraft-and-improve-detection-strategies/

LimaCharlie (Commercial Tool)


https://www.limacharlie.io/

Attacking Serverless Servers: Reverse-Engineering the AWS, Azure, and GCP Function
Runtime
https://youtu.be/DegAofI3fR0

Microsoft Security—detecting empires in the cloud (APT40)


https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/

Cloud post mortems


https://github.com/danluu/post-mortems

Google Workspace Data Retention and Lag Times


https://support.google.com/a/answer/7061566

Hawk: Powershell based tool for gathering information related to O365 intrusions
https://github.com/T0pCyber/hawk

Microsoft Graph Explorer


https://developer.microsoft.com/en-us/graph/graph-explorer

AlteredSecurity/365-Stealer
365-Stealer is a phishing tool written in python3 which abused App registration to grant
consent from victim which leads to Illicit Consent Grant Attack
https://github.com/AlteredSecurity/365-Stealer

Phishing playbooks:
https://www.dragonadvancetech.com/reports/O365-IR%20Playbook_v1.0.pdf
https://github.com/PwC-IR/Business-Email-Compromise-Guide
https://www.kyberturvallisuuskeskus.fi/sites/default/files/media/publication/
T_MS365_eng_sivut200919HR.pdf

Microsoft Incident Response Playbooks


https://docs.microsoft.com/en-us/security/compass/incident-response-playbooks

PwC-IR/Office-365-Extractor
https://github.com/PwC-IR/Office-365-Extractor

Day 2
FIRST: Global Forum of Incident Response and Security Teams
https://www.first.org/

AWS Accounts as Security Boundaries


https://matthewdf10.medium.com/aws-accounts-as-security-boundaries-97-ways-data-can-
be-shared-across-accounts-b933ce9c837e

How to Enable Logging on every AWS Service


https://matthewdf10.medium.com/how-to-enable-logging-on-every-aws-service-in-existence-
circa-2021-5b9105b87c9

The AWS exploitation framework


https://github.com/RhinoSecurityLabs/pacu

ScoutSuite - Multi-Cloud Security Auditing Tool


https://github.com/nccgroup/ScoutSuite

Amazon Control Tower


https://aws.amazon.com/controltower/

AWS to Azure services comparison - Azure Architecture Center


https://docs.microsoft.com/en-us/azure/architecture/aws-professional/services

GCP to Azure Services Comparison - Azure Architecture Center


https://docs.microsoft.com/en-us/azure/architecture/gcp-professional/services
AWS forensics package
https://libcloudforensics.readthedocs.io/en/latest/source/libcloudforensics.providers.aws.html

Learn AWS security with the flAWS challenge


http://flaws.cloud/

Event-Driven Response - AWS Security Incident Response Guide


https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/
event-driven-response.html

AWS Digital Forensics Automation at Goldman Sachs - AWS Online Tech Talks
https://www.youtube.com/watch?v=CR4_a-TO_gw

AVML - Acquire Volatile Memory for Linux


https://github.com/microsoft/avml

AWS Forensics: EC2 Volatile Memory Capture


https://www.linkedin.com/pulse/aws-forensics-ec2-volatile-memory-capture-stephen-
mcmaster/

AWS Security Incident Response Guide


https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/
using-hibernation-for-memory-capture.html

Day 3
Cloud services comparison table
https://comparecloud.in/

USB-over-TCP or USB-over-RDP
https://www.net-usb.com/usb-over-rdp/
https://www.net-usb.com/usb-over-tcp/

Microsoft RemoteFX USB Redirection


https://techcommunity.microsoft.com/t5/security-compliance-and-identity/introducing-
microsoft-remotefx-usb-redirection-part-1/ba-p/247035

Dump Azure AD Connect credentials for Azure AD and Active Directory


https://github.com/fox-it/adconnectdump
Azure AD Connect for Red Teamers
https://blog.xpnsec.com/azuread-connect-for-redteam/

Day 4
Automation and Scaling of Digital Forensics Tools
https://github.com/google/turbinia
https://turbinia.readthedocs.io/en/latest/user/how-it-works.html

Gcploit from decon/blackhat talk


https://github.com/dxa4481/gcploit
https://www.youtube.com/watch?v=Ml09R38jpok

Tutorial on privilege escalation and post exploitation tactics in Google Cloud Platform
environments
https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-
cloud-platform/

SygniaLabs/security-cloud-scout
https://github.com/SygniaLabs/security-cloud-scout
Bloodhound for Azure & AWS

forsetisecurity.org
Tools to secure Google Cloud Platform
https://forsetisecurity.org/

BloodHoundAD/AzureHound
https://github.com/BloodHoundAD/AzureHound

GCP Packet Mirroring


https://cloud.google.com/vpc/docs/packet-mirroring

Docker Security - OWASP Cheat Sheet Series


https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

keikoproj/kube-forensics
https://github.com/keikoproj/kube-forensics

Kube-Query: A Simpler Way to Query Your Kubernetes Clusters


https://blog.aquasec.com/kube-query-osquery-kubernetes-clusters

You might also like