Incident Response and Digital Forensics
Cloud and Identity Incident Investigation
From cloud audit and sign-in logs, we determine which identity accessed what and when. We close all remaining access held by the attacker.
What it is
In cloud and SaaS applications, attackers typically compromise an identity rather than a server. Consent granted to a malicious application remains valid even after a user's password is changed. Evidence is found in the audit logs of services such as Microsoft Entra ID, AWS CloudTrail or Google Workspace. These logs are retained for a limited time based on license and settings, so the first step is to export them.
Scope
- Exporting and preserving sign-in, audit and management logs
- Detecting unusual sign-ins and stolen session tokens
- Reviewing app consents, new access keys and role assignments
- Checking new methods registered for multi-factor authentication
- Checking changes to identity federation and trust settings
- Revoking sessions and removing attacker-added access
The need
When organizations need it
- When an admin account shows a successful sign-in from a country no one has visited.
- When servers no one launched appear on the cloud bill.
- When an employee reports a multi-factor authentication prompt they did not initiate.
Method
How we work
-
Preserving logs
Before retention expires, we export all relevant audit logs and record their integrity.
-
Identity map
We determine which resources the compromised identity accessed, with what rights, and when.
-
Hunting for persistence
We identify the app consents, keys and authentication methods the attacker added.
-
Closing access
We revoke sessions and remove added access. We set up alerts for any return attempts.
Outcome
What you have at the end
You see in the logs where the compromised identity accessed and what it changed. Attacker-added access is removed and any return attempt is monitored.
Frequently asked questions
Isn't changing the password enough?
Usually not. Consents granted to malicious apps and authentication methods added by the attacker are not affected by a password change. Active sessions must also be revoked separately.
How far back do the logs go?
It depends on the service, license and settings. Some logs are kept for only a few days or weeks. That is why the first step after an incident is to export them.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting