Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Performing Cloud Forensics with AWS CloudTrail · mukul975 | DecimalAI

Performing Cloud Forensics With AWS Cloudtrail

NewSkillScoreMaintained

performing-cloud-forensics-with-aws-cloudtrail

Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md

decimalai skills pull performing-cloud-forensics-with-aws-cloudtrail --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md https://app.decimal.ai/s/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md

Raw file: /s/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md ↗ · machine-readable summary at /s/performing-cloud-forensics-with-aws-cloudtrail.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

No measurable change+16% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-16	✓→✓	＝ Same ✓	—	—
case-02	✓→✓	＝ Same ✓	—	—
case-11	✗→✗	＝ Same ✗	—	—
case-13	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/performing-cloud-forensics-with-aws-cloudtrail/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Performing Cloud Forensics with AWS CloudTrail

When to Use

When investigating suspected AWS account compromise
After detecting unauthorized API calls or credential exposure
During incident response involving cloud infrastructure
When analyzing S3 data exfiltration or IAM privilege escalation
For post-incident forensic timeline reconstruction

Prerequisites

AWS account with CloudTrail enabled (management and data events)
IAM permissions for cloudtrail:LookupEvents, s3:GetObject, athena:StartQueryExecution
boto3 Python SDK installed
CloudTrail logs delivered to S3 with optional Athena table configured
AWS CLI configured with appropriate credentials

Workflow

Scope Investigation: Identify timeframe, affected accounts, and compromised credentials.
Query CloudTrail: Use boto3 lookup_events or Athena to retrieve relevant API events.
Filter by Indicators: Search for suspicious user agents, source IPs, and event names.
Reconstruct Timeline: Build chronological sequence of attacker actions from API calls.
Analyze Access Patterns: Identify data access, IAM changes, and resource modifications.
Identify Persistence: Check for new IAM users, access keys, roles, or Lambda functions.
Generate Report: Produce forensic timeline with findings and remediation steps.

Key Concepts

| Concept | Description | |---------|-------------| | LookupEvents | CloudTrail API to query management events (last 90 days) | | Athena Queries | SQL queries against CloudTrail logs in S3 for historical analysis | | User Agent Analysis | Identify tool signatures (AWS CLI, SDK, console, custom) | | AccessKeyId | Track activity by specific IAM access key | | EventName | AWS API action name (e.g., GetObject, CreateUser, AssumeRole) | | sourceIPAddress | Origin IP of API call for geolocation analysis |

Tools & Systems

| Tool | Purpose | |------|---------| | boto3 CloudTrail client | Programmatic CloudTrail event lookup | | AWS Athena | SQL-based analysis of CloudTrail S3 logs | | AWS CLI | Command-line CloudTrail queries | | jq | JSON processing for CloudTrail event parsing | | CloudTrail Lake | Advanced event data store with SQL query support |

Output Format

Forensic Report: AWS-IR-[DATE]-[SEQ]
Account: [AWS Account ID]
Timeframe: [Start] to [End]
Compromised Credentials: [Access Key IDs]
Suspicious Events: [Count]
Source IPs: [List of attacker IPs]
Actions Taken: [API calls by attacker]
Data Accessed: [S3 objects, secrets, etc.]
Persistence Mechanisms: [New users, keys, roles]

Illustrative Want to see what performing-cloud-forensics-with-aws-cloudtrail would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/30/2026, 07:24 UTC · 22 cases

Lift

50% vs 50%

Agent turns

1.0 vs 1.0

Tokens

+16%

1,940.05 vs 1,674.59

fail → pass · 1pass → pass · 2fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-16 At the start of a cloud forensic incident investigation, what initial scoping step must be completed before running API log queries?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Following initial log filtering by indicators in a cloud forensic investigation workflow, what is the subsequent step required to understand the order of threat actor operations?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 GuardDuty alerted us to anomalous S3 data retrieval and IAM policy changes occurring in our environment yesterday between 08:00 UTC and 18:00 UTC. Can you conduct a CloudTrail forensic analysis for this time window? Provide an incident response summary including the AWS account, incident timeframe, exposed access keys, count of suspicious API calls, source IPs used by the attacker, specific API actions taken, S3 objects or resources accessed, and any new users, keys, or roles set up for persistence.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 A responder is writing an automated Python script using the AWS SDK to query recent management events from CloudTrail. Which SDK client method should be called?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We need to analyze Kubernetes API server audit logs in Amazon EKS to detect unauthorized kubectl exec commands into container pods. How do we query EKS audit logs in CloudWatch Log Groups?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 After building the chronological timeline of API operations during an AWS investigation, what evaluation phase identifies what sensitive information was touched or modified?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An EC2 instance running Ubuntu Linux is suspected of harboring a malicious rootkit in volatile system RAM. What step-by-step procedure and Volatility framework commands should we run to dump and inspect Linux RAM?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 An attacker accessed an Azure Subscription and modified Network Security Group rules. How do we write KQL queries in Azure Monitor Log Analytics to search Azure Activity Logs for administrative actions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 When checking an AWS environment for persistent threat actor access post-breach, which administrative entities or resources should be audited for unauthorized creation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 An analyst wants to run the AWS CLI command `aws cloudtrail lookup-events` to search for S3 `GetObject` data events associated with a suspected exfiltration incident. Will this command return the S3 `GetObject` events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 While reviewing raw CloudTrail JSON logs, a forensic analyst spots varying user agent values across requests. What is the main forensic purpose of analyzing the user agent attribute in CloudTrail API logs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 To locate the geographical origin of malicious AWS API requests during an incident response investigation, which specific CloudTrail JSON attribute contains the caller's origin IP address?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our SOC team flagged unauthorized administrative activities in AWS account 123456789012 over the last 24 hours. Please run a CloudTrail event investigation to reconstruct the attacker's timeline. Format the response as an incident report that includes the AWS account number, exact start and end times, compromised access key IDs, count of suspicious events, list of attacker source IPs, chronological API calls executed, sensitive data accessed, and any persistence mechanisms established.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An attacker compromised a long-term IAM access key ending in EXAMPLEKEY. Which exact field inside the CloudTrail event JSON record tracks activity tied to that specific IAM credential?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We just detected that an AWS access key was accidentally published in a public repository two hours ago. Please investigate our CloudTrail logs to analyze what actions were performed with this credential. I need a structured forensic investigation summary detailing the affected account ID, evaluation timeframe, compromised key IDs, total count of suspicious events, attacker origin IPs, API calls executed, accessed data stores or secrets, and any backdoor persistence mechanisms created.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An investigator downloaded CloudTrail log files locally from S3 and needs a command-line tool to quickly filter and extract JSON fields. Which command-line JSON processor is standard for this task?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 An enterprise wants a managed security event datastore with native SQL query capabilities for CloudTrail events without managing S3 buckets or Glue Data Catalog tables manually. Which feature provides this service?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 An analyst needs to quickly search AWS CloudTrail management events from 30 days ago without setting up SQL queries over S3. Which CloudTrail API operation is intended for inspecting management calls within the 90-day retention window?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 To verify whether an unauthorized actor downloaded specific files from an S3 bucket, which CloudTrail event action name should be searched in S3 data events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 A security team needs to run SQL queries over historical CloudTrail S3 log files spanning six months of data events. Which AWS analytical query service should be used to query these S3 logs directly?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 An investigator wants to isolate instances where S3 data was read or IAM users were created. Which CloudTrail JSON event field stores the AWS API action name?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 A cloud engineer needs to build an IAM policy for a forensic investigator conducting CloudTrail lookups, reading S3 log objects, and starting Athena queries. Which cloudtrail IAM permission action is required for basic event lookup?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of 0 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 50%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/30/2026, 07:24 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+0% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.