npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-incident-containment-procedures, or copy the skill folder into ~/.claude/skills/performing-cloud-incident-containment-procedures/.
Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-cloud-incident-containment-procedures/SKILL.md
SKILL.md (verbatim)
name: performing-cloud-incident-containment-procedures
description: Execute cloud-native incident containment across AWS, Azure, and GCP using platform
CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups
and network ACLs, and preserve forensic evidence via snapshots. Use when responding to a cloud
security incident that requires stopping lateral movement while keeping evidence intact for
later investigation.
domain: cybersecurity
subdomain: incident-response
tags:
- cloud-security
- incident-containment
- aws
- azure
- gcp
- cloud-forensics
- credential-revocation
- network-isolation
mitre_attack:
- T1486
- T1490
- T1070
- T1078
- T1021
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Restore Access
- Password Authentication
- Biometric Authentication
- Strong Password Policy
- Restore User Account Access
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01
Performing Cloud Incident Containment Procedures
Overview
Cloud incident containment requires cloud-native approaches that differ significantly from traditional on-premises response. Containment procedures must leverage platform-specific controls including security groups, IAM policies, network ACLs, and service-level isolation to restrict compromised resources while preserving forensic evidence. According to the 2025 Unit 42 Global Incident Response Report, responding to cloud incidents requires understanding shared responsibility models, ephemeral infrastructure, and API-driven operations. Effective containment involves credential revocation, resource isolation, evidence snapshot creation, and automated response playbook execution.
When to Use
When conducting security assessments that involve performing cloud incident containment procedures
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Familiarity with incident response concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
AWS Containment Procedures
1. Credential Compromise Containment
# Disable compromised IAM user access keys
aws iam update-access-key --user-name compromised-user \
--access-key-id AKIA... --status Inactive
# List and disable all access keys for user
aws iam list-access-keys --user-name compromised-user
aws iam delete-access-key --user-name compromised-user --access-key-id AKIA...
# Attach deny-all policy to compromised user
aws iam put-user-policy --user-name compromised-user \
--policy-name DenyAll \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*"
}]
}'
# Revoke all active sessions for IAM role
aws iam put-role-policy --role-name compromised-role \
--policy-name RevokeOldSessions \
--policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"DateLessThan": {"aws:TokenIssueTime": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}
}
}]
}'
# Invalidate temporary credentials by updating role trust policy
aws iam update-assume-role-policy --role-name compromised-role \
--policy-document '{"Version":"2012-10-17","Statement":[]}'
2. EC2 Instance Isolation
# Create quarantine security group (no inbound, no outbound)
aws ec2 create-security-group --group-name quarantine-sg \
--description "Quarantine - No traffic allowed" --vpc-id vpc-xxxxx
# Remove all rules from quarantine SG (default allows outbound)
aws ec2 revoke-security-group-egress --group-id sg-quarantine \
--ip-permissions '[{"IpProtocol":"-1","FromPort":-1,"ToPort":-1,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'
# Take forensic snapshot BEFORE containment
aws ec2 create-snapshot --volume-id vol-xxxxx \
--description "Forensic snapshot - IR Case 2025-001" \
--tag-specifications 'ResourceType=snapshot,Tags=[{Key=IR-Case,Value=2025-001}]'
# Apply quarantine security group to compromised instance
aws ec2 modify-instance-attribute --instance-id i-xxxxx \
--groups sg-quarantine
# Tag instance as compromised
aws ec2 create-tags --resources i-xxxxx \
--tags Key=IR-Status,Value=Contained Key=IR-Case,Value=2025-001
# Capture memory (if SSM agent available)
aws ssm send-command --instance-ids i-xxxxx \
--document-name "AWS-RunShellScript" \
--parameters 'commands=["dd if=/dev/mem of=/tmp/memory.dump bs=1M"]'
START: Compromised AWS Credentials Detected
|
v
[Identify Scope]
|-- Which IAM user/role is compromised?
|-- What permissions does it have?
|-- Review CloudTrail for unauthorized actions
|
v
[Immediate Containment]
|-- Disable all access keys
|-- Attach deny-all inline policy
|-- Revoke active sessions (date condition)
|-- Update role trust policy if needed
|
v
[Evidence Preservation]
|-- Export CloudTrail logs to S3 with Object Lock
|-- Snapshot any accessed resources
|-- Document all API calls by compromised identity
|
v
[Impact Assessment]
|-- What resources were accessed?
|-- Was data exfiltrated?
|-- Were new resources created?
|-- Were other accounts compromised?
|
v
[Remediation]
|-- Rotate all credentials
|-- Remove unauthorized resources
|-- Update IAM policies
|-- Enable MFA enforcement
|
v
END: Containment Complete
Workflow 2: Cloud VM Compromise Response
START: Compromised Cloud VM Detected
|
v
[Preserve Evidence First]
|-- Create disk snapshot immediately
|-- Capture instance metadata
|-- Export relevant logs
|
v
[Network Isolation]
|-- Apply quarantine security group/NSG
|-- Remove public IP addresses
|-- Block outbound traffic
|-- Maintain forensic access only
|
v
[Assess Blast Radius]
|-- Check lateral movement indicators
|-- Review IAM role attached to instance
|-- Check for data access to other services
|
v
[Forensic Analysis]
|-- Mount snapshot to forensic workstation
|-- Analyze disk for malware/tools
|-- Review instance logs
|
v
[Recovery]
|-- Rebuild from known-good image
|-- Apply security hardening
|-- Restore from clean backup
|
v
END: VM Contained and Rebuilt
Workflow 3: Multi-Cloud Containment
START: Multi-Cloud Incident
|
v
[Identify Affected Cloud Platforms]
|-- AWS accounts affected?
|-- Azure subscriptions affected?
|-- GCP projects affected?
|
v
[Parallel Containment]
|-- AWS: SecurityHub + GuardDuty response
|-- Azure: Defender + Sentinel playbooks
|-- GCP: SCC + Chronicle response
|
v
[Cross-Cloud Credential Check]
|-- Shared credentials between platforms?
|-- Federated identity compromise?
|-- Third-party integrations affected?
|
v
[Unified Evidence Collection]
|-- Centralize logs from all platforms
|-- Normalize timestamps to UTC
|-- Build cross-cloud timeline
|
v
END: Multi-Cloud Containment Complete