Forensic Artifacts in Free Tiers of Azure, GCP, and AWS

The talk covers a common gap: teams spin up cloud resources for demos or projects on free tiers, with default settings and little monitoring, and security only gets involved after something looks wrong. The speaker built a database and virtual machines on each of the three major providers, then emulated two threats by hand, a cryptocurrency miner and an intruder who used cached credentials to reach the database and create a new account.

For each provider, the speaker reviewed what was recorded. Windows endpoint logs gave the clearest view of the initial access and the persistence. Cloud-side logging varied: GCP produced useful audit and request metadata out of the box, Azure's logs showed the source of single-factor logins, and AWS recorded little unless optional monitoring was enabled beforehand. Monitoring switched on after an intrusion usually covered only the last few minutes, and deleting an instance removed its logs. Detection of the miner and beaconing traffic failed on all three.

The practical takeaways are to turn on logging and default security options across every subscription before deployment, take disk snapshots quickly after a suspected compromise, and assume free-tier logs are limited. The speaker noted that automated collection for these gaps mostly comes from paid services, and proposed a shared catalogue of artifacts to check.