npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When investigating suspected AWS account compromise
Performs AWS cloud forensics using CloudTrail logs to reconstruct attacker timelines, identify compromised credentials, and analyze suspicious API call patterns.
Performs AWS cloud forensics using CloudTrail logs to reconstruct attacker activities, identify compromised credentials, and analyze API call patterns. Useful for incident response on suspected account breaches.
Implements AWS CloudTrail log analysis using Athena, CloudWatch Logs Insights, and SIEM for security monitoring, threat detection, and forensic investigation of unauthorized access and suspicious API activity.
Share bugs, ideas, or general feedback.
| Concept | Description |
|---|---|
| LookupEvents | CloudTrail API to query management events (last 90 days) |
| Athena Queries | SQL queries against CloudTrail logs in S3 for historical analysis |
| User Agent Analysis | Identify tool signatures (AWS CLI, SDK, console, custom) |
| AccessKeyId | Track activity by specific IAM access key |
| EventName | AWS API action name (e.g., GetObject, CreateUser, AssumeRole) |
| sourceIPAddress | Origin IP of API call for geolocation analysis |
| Tool | Purpose |
|---|---|
| boto3 CloudTrail client | Programmatic CloudTrail event lookup |
| AWS Athena | SQL-based analysis of CloudTrail S3 logs |
| AWS CLI | Command-line CloudTrail queries |
| jq | JSON processing for CloudTrail event parsing |
| CloudTrail Lake | Advanced event data store with SQL query support |
Forensic Report: AWS-IR-[DATE]-[SEQ]
Account: [AWS Account ID]
Timeframe: [Start] to [End]
Compromised Credentials: [Access Key IDs]
Suspicious Events: [Count]
Source IPs: [List of attacker IPs]
Actions Taken: [API calls by attacker]
Data Accessed: [S3 objects, secrets, etc.]
Persistence Mechanisms: [New users, keys, roles]