An analyst is reviewing a case involving an actor who leveraged PowerShell Cloud Shell to achieve their goals. Where can the analyst And logs depleting this activity?

Azure Cloud Shell is a browser-based shell integrated into the Azure portal. All significant activities performed within an Azure environment, including the initiation and use of services like Cloud Shell, are recorded in the platform's central logging mechanism. These are known as Azure Monitor Activity Logs (which encompass what were formerly called Audit Logs). These logs provide a detailed, authoritative record of subscription-level events, capturing who performed an action, when it occurred, from what IP address, and the status of the operation. Therefore, an analyst would find definitive evidence of an actor leveraging PowerShell Cloud Shell in the environment's audit logs.

A. Network flow logs for the environment: These logs would only show network traffic to Azure endpoints, but would lack the specific context that a Cloud Shell session was initiated or the commands run.
B. .wgethsts file: This is a local file related to the wget command and HSTS security policy. It is entirely unrelated to PowerShell Cloud Shell activity.
D. .bashhistory file: This file records command history for a local Bash shell. While Cloud Shell can run Bash, its history is persisted in a cloud-based file share, not a local endpoint's file system.

1. Microsoft Azure Documentation (Official Vendor Documentation): The Azure Activity log is a platform log that provides insight into subscription-level events. It records operations on resources, such as the creation or modification of a resource, and the start of a Cloud Shell session is considered such an operation.

Source: Microsoft Learn, "Azure Activity log," Overview section. Retrieved from https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log.

2. Microsoft Azure Documentation (Official Vendor Documentation): Audit logs, now part of Microsoft Entra ID diagnostic settings, contain information about changes and activities within a tenant. This includes user actions and service principal activity, which would cover the use of an integrated service like Cloud Shell.

Source: Microsoft Learn, "Microsoft Entra audit logs," What are they? section. Retrieved from https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs.

3. SANS Institute (Reputable University-Affiliated Research): In forensic analysis of cloud environments like Azure, the primary source of truth for user and administrative activity is the platform's native logging and auditing features. For Azure, this is the Activity Log, which tracks control-plane actions.

Source: SANS Institute, "FOR509: Cloud Forensics and Incident Response" courseware syllabus. The course emphasizes the critical role of Azure Activity Logs and Microsoft Entra ID logs for investigating incidents.