Threat hunting in the cloud
summary
Claims that cloud hunting succeeds only with combined CSP API logs plus full endpoint telemetry, demonstrated by ingesting CloudTrail/VPC flow logs and S3-shipped files into ELK and spotting a PACU permission brute force. Shows attacker methods (API run-command, custom script extensions, SSM, user-data) where scripts drop to disk and can be deleted, so script block logging is essential to recover decoded PowerShell. Tests use PACU and MicroBurst; TAP agents work but cost and portability limit them.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:35What is a cloud service provider?
- 2:35Shared responsibility model (IaaS)
- 3:14Cloud service provider adoption aws
- 4:44Infosec community on cloud services How well do traditional network Security tools work in cloud environments?
- 6:05What are they after? It depends on the type of attacker
- 7:17Attacks in the field
- 12:09Enterprise architecture example
- 12:46AWS architecture example
- 18:34CSP Attacker Tools
- 18:54Catching direct attacks against the CSP
- 22:02Endpoint considerations
- 24:54Endpoint visibility - forensics data
- 27:55Endpoint visibility - PowerShell visibility
- 35:34Executing code - Azure API | Endpoint execution
- 40:17Executing code - AWS API | Endpoint execution
related talks
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
41mBuilding a Valid Threat Library for Cloud Based Applications
50mThe Anatomy of Cloud Attacks
31mThreat Hunting — Demystified
11mCompeting for cloud security talent—win without the fight (PRT043)
20mFantastic AWS Attacks and Where to Find Them
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
50mInsights into New Supply Chain and Cloud-Identity Attacks