Zone // Cloud Forensics

Cloud Infrastructure Hologram

Trace cluster propagation and egress points across AWS, Azure, and GCP. Collect evidence and submit flags to advance the case.

Live Trace

SRC 185.22.14.207

→ s3://prod-evidence-bucket

K8s Pods248 ACTIVE

AWS: ACTIVEAZURE: ALERTGCP: ANALYZING

CloudTrail / Multi-Cloud Audit ExplorerANOMALY × 4

ts	account	principal	action	resource
13:58:04	aws:111-prod	ci-bot	s3:ListBucket	prod-evidence-bucket
13:59:41	aws:111-prod	anon-presign	s3:GetObject	prod-evidence-bucket/*
14:00:12	azure:contoso	mi-fnapp-7	api.invokeFunction	fn-extract-keys
14:00:48	gcp:aegis-research	svc-runtime	iam.serviceAccounts.signBlob	projects/aegis
14:01:02	aws:111-prod	ci-bot	ec2:DescribeInstances	*
14:02:22	aws:111-prod	anon-presign	s3:PutObject	prod-evidence-bucket/exfil.tgz

Cross-account trace · 3 providers · click Anomaly to isolate the lateral-movement chain.

SIEM / Multi-Cloud Event StreamLIVE

[14:02:11] CLOUD_INIT: Attaching CloudTrail stream us-east-1

[14:02:12] HEURISTIC: Found anomalous presigned URL pattern

[14:02:15] S3_AUDIT: prod-evidence-bucket policy reviewed

[14:02:16] LOG_FLUSH: Success

[14:02:19] S3_ENUMERATION_ATTEMPT by user_882

[14:02:22] EVIDENCE_LOCKED: container_snapshot_v2

[14:02:25] CloudTrail anomaly: api.invokeFunction x412

[14:02:28] K8S_AUTH_FAIL on node-72 (pod-auth-7x9) src=185.22.14.207

Active

AWS

Alert

Azure

Analyzing

GCP

Breach

Kubernetes

Forensic Toolkit

Live network capture from the compromised pod. Filter to suspicious traffic to spot the C2 channel.

#	Source	Destination	Proto	Port	Flag
1	10.0.4.21	185.22.14.207	TCP	443	SYN
2	185.22.14.207	10.0.4.21	TCP	443	SYN-ACK
3	10.0.4.21	185.22.14.207	TCP	4444	PSH
4	185.22.14.207	10.0.4.21	TCP	4444	PSH
5	10.0.4.21	8.8.8.8	UDP	53	DNS
6	10.0.4.21	185.22.14.207	TCP	22	RST

Chain of Custody — Case #118-CLOUD-LATERAL3 ENTRIES · SHA-256