This repo contains scripts I've written to aid in digital forensics and incident response processes in Microsoft's Azure cloud.
My scripts usually aren't intended to be copy/pasted and run as-is. They have configuration points you will need to define before you can use them in your environment.
Run-AzureVmMemoryCollection.ps1 - this is a Windows PowerShell script which allows you to download a tools kit from an Azure Storage container, execute a full memory dump, and exfil the memory dump to an Azure Storage container. This allows you as a forensic analyst to actually obtain memory from a Windows Azure VM for analysis.
I also find it useful to write brief HOW TO documents. These primarily remind me how to use things, but I figure they'll also help other folks. I could put these on a blog or something somewhere but that's annoying when they could just all be right here with the scripts. Por que no los dos?
HOW TO: Deploy Azure Custom Script Extensions
HOW TO: Deploy Azure Run Command Extensions
FORENSIC ARTIFACTS: Azure Custom Script Extensions - Azure Portal Artifacts
FORENSIC ARTIFACTS: Azure Custom Script Extensions - Windows VM Artifacts
FORENSIC ARTIFACTS: Azure Custom Script Extensions - Linux VM Artifacts
FORENSIC ARTIFACTS: Azure Run Command Extensions - Azure Portal Artifacts
FORENSIC ARTIFACTS: Azure Run Command Extensions - Windows VM Artifacts
FORENSIC ARTIFACTS: Azure Run Command Extensions - Linux VM Artifacts
FORENSIC ARTIFACTS: Attacker Source IP Identification With IPsec Audit Events
Azure Service Endpoints - these may help you in your reviews of firewall logs, DNS logs, local browser artifacts, and more to determine the origin of a file, what an application may have been communicating with, or to diff against to identify potential phishing or abuse of lookalike domains.
Azure Resource Provider List - these are good to reference against the Azure Service Endpoints file so we can be on the same page about which endpoint corresponds to which Resource Provider in Azure. This is critical because you'll see the Resource Provider full names in most portal.azure.com URLs on your network.
These are not just a regurgitation of the usual documentation found online. There's actual context here.
FORENSIC ARTIFACTS: Windows Event 4653
The DFIR field has a lot of good folks, and a lot of good tools available, but they do tend to be widely scattered and in various states of usefulness. As a result I frequently utilize a plethora of tools for my work, and I am not always aware of all tools that could fulfill a particular need.
Some of my scripts may involve the use of closed-source tools that require payment to access. When this is the case I will make it clear in the script. As with any script there is a lot of flexibility, so in some cases a FOSS tool I haven't used or been aware of could work well for you and you can swap it into the script.
I do want to encourage you to support the developers of your favorite DFIR tools, whether they require payment, request optional payment, or produce them asking nothing in return. Support could mean:
There are many ways to express gratitude! Just don't ignore the hard work put into this stuff. We all stand on the shoulders of giants and must recognize that fact. :)