Hunting Supply Chain Threats Using Anomaly Detection
summary
Case study shows anomaly detection on CloudTrail APIs (SQL-based analytics, MaxMind geo enrichment, planned Airflow pipeline) catching a supply‑chain compromise by flagging rare source country for an action and new action for user events. Concrete artifacts include get-caller-identity, listBuckets, snapshot sharing and getFederationToken calls; a medium dataset (~300M events) yields ~200–250 rare-action hits for triage. Detection surfaces a third‑party account doing assume‑role/describe‑instances/start‑stop activity; access is revoked and the anomaly hunt proves effective.
AI-written summary · about
chapters (5)
- 0:00Introduction and background
- 11:12Problem with credentialed access
- 23:42Detection challenges in cloud APIs
- 37:52Anomaly detection in practice
- 48:23Emerging threats and future work
related talks
48mCatch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection
40mMulti-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds
24mThreat Hunting Powered by Efficient and Straightforward Anomaly Detection on Your Data Lake
28mPatterns for scalable security detections on AWS
20mFantastic AWS Attacks and Where to Find Them
34mData Mining for Security Anomalies
43mThreat hunting in the cloud
25mThe truth about anomaly detection in API security