Many attacks today never touch a physical computer: they go through the administrator account, the cloud console and the code deployment pipeline. The examination reconstructs that path after the fact, from records these platforms keep for only a short time.
In recent incidents, the centre of the attack is almost never a machine. It is an identity. The attacker obtains an account, escalates privilege, creates resources in the cloud and alters a pipeline, the automated chain that tests and publishes code. The traces sit in the platforms' authentication, audit and activity logs.
This unit does not do containment or recovery of the environment. The work is forensic and starts after the fact. It answers how the attacker got in, with which account, at what minute, what he did, what he took and since when he had been there. The result is an expert report or technical opinion for the insurer, for the ANPD (Brazil's data protection authority), for the cloud provider or for the lawsuit.
The urgency here is of a different kind. The native logs of these platforms have short retention, which varies with the plan contracted. Preserving those logs, with hash and chain of custody, is the first act of the examination.
Whoever controls identity controls the rest. The central question is how the attacker became an administrator, and at what minute.
Reuse of stolen credentials (Pass-the-Hash), abuse of Kerberos delegation (the mechanism that lets a service act on behalf of the user), attempts to copy the passwords of the whole domain (DCSync). Also group policy altered to run the intruder's commands and copying of the credential database through a server snapshot. Each technique leaves its own events on the domain controllers.
Sign-in and audit logs, registered authentication methods, permissions granted to applications, mailbox rules created by the intruder and administrators removed. This is where tenant takeover (the company's environment in Microsoft's cloud) and business e-mail compromise show up.
When the on-premises domain synchronises with the cloud, the attack crosses both. The examination puts events from different sources on the same timeline, in the same time zone. The order of events decides where the attack began.
A password reset validated only by SMS can become an entry point, all the more so on an account with permanent administrator privilege. The examination shows who reset it, through which channel and what they did next.
"We had MFA" is the sentence heard most often after an account is taken over. The second factor reduces the risk, but it does not end the discussion. Circumventing multi-factor authentication is today one of the most frequent demands in this area.
The logs usually show which route it was: device, address, browser, session reused without a new login, new method registered minutes earlier. And the answer changes the discussion of liability. Misconfiguration, user carelessness, supplier failure and inside participation lead to different outcomes with the insurer, the ANPD and the labour courts.
Forensic examination of AWS, Microsoft Azure and Google Cloud, of Kubernetes clusters (the platform that runs and coordinates containers, the packages in which applications run today) and of code repositories and pipelines, what the technology side calls DevOps. Collection uses read-only access. When the provider reports the hash of the data, the copy is checked against it.
An application flaw that leads to the instance metadata service (the internal address where the virtual machine keeps its temporary credentials), theft of those credentials and creation of malicious tasks. The vector is proved by cross-checking the cloud activity logs with the application log, to the second.
Acquisition of nodes and volumes, cluster audit logs and commands executed. The examination shows what ran, under which service account and where the data went out.
Access keys forgotten in the code, a pipeline altered to run the intruder's commands and legitimate remote access tools used as cover. The version history shows who changed what, and when.
Sometimes the intruder does not want the data. He wants the victim's computing capacity. He creates virtual machines to mine cryptocurrency, process video, crack passwords or launch denial-of-service (DDoS) attacks against third parties. The company discovers the attack through the invoice.
The examination shows which resources were created, when, in which regions, by which identity and from where. It separates legitimate use from the intruder's use and delimits the period of abuse. The report supports the billing dispute with the provider. In the case of DDoS, it can also document that the company was used in the attack, and is not its author.
A company received from its cloud provider an additional charge it did not recognise. The account held virtual machines created without authorisation, mining cryptocurrency.
The examination reconstructed, from the account logs, the creation of those machines and separated them from the company's legitimate use.
The forensic work supported the billing dispute with the provider. The additional charge was cancelled.
An attack hit an organisation's on-premises domain and its cloud. The question was where it had started.
The examination correlated millions of events from two domain controllers, grouped by event type, with the cloud logs, on a single timeline.
The on-premises domain was compromised almost half an hour before the cloud. That was the starting point of the inquiry.
A company pays a supplier into a bank account changed by e-mail. The finance director's mailbox had MFA switched on, and the insurer asks how the account was taken over.
In this scenario, the examination would look at the Microsoft 365 sign-in and audit logs. It might find a session token reused in another country, without new authentication, and a mailbox rule created minutes later to hide the real supplier's replies.
The report would show the technique, the moment of the takeover and what the intruder read and sent. That is the basis for the coverage discussion and for the action against whoever received the money.
See also
Digital Authorship and Subscriber Data Disclosure → Anti-Forensics and Destroyed Evidence → LGPD, ANPD and Data Breach Forensics → Financial Fraud and Payment Systems Forensics → Corporate Investigations and Compliance → Computer Forensics and Digital Investigation → Insurance and Cyber Claims →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case