HANDS-ON WORKSHOP | Cloud Security Forensics & Incident Response: Aviata Chapter 9

This workshop covered Google Cloud fundamentals, IAM structure, and logging mechanisms, followed by a hands-on investigation of a simulated supply chain attack using Soft Elk to trace lateral movement and privilege escalation.

Key Takeaways:
• Google Cloud IAM relies on binding principals (users/service accounts) to roles via policies applied to resources, with default service accounts being a primary attack vector 10:45
• Audit logs are categorized into control plane (Admin Activity) and data plane (Data Access); Data Access logs are disabled by default, creating visibility gaps for investigators 35:20
• Attackers exploit default compute service accounts with Editor roles to impersonate users, create API keys, and laterally move via snapshots or container deployments 45:10
• Investigation pivoting involves tracing failed API key creations to source IPs, then to Artifact Registry interactions, and finally to Kubernetes deployment events 55:30
• Parsing limitations in external SIEMs can obscure nested JSON data; raw logs or native Cloud Logging are often required for complete attribution 60:15

The session demonstrated that proactive IAM auditing and robust log parsing are essential for detecting sophisticated cloud-based supply chain attacks.

Sources:

• 10:45 Introduction to Google Cloud IAM structure and service account risks
• 35:20 Overview of Admin Activity, System Event, Login Audit, and Data Access logs
• 45:10 Explanation of lateral movement techniques via default service accounts and snapshots
• 55:30 Live demonstration of tracing an attack chain using Soft Elk filters
• 60:15 Discussion on log parsing challenges and the importance of raw data analysis