Catch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection
summary
Summarizes practical results: a sanitized 25,000-row CloudTrail dataset and Jupyter notebooks that run a pyod ensemble and K‑means, plus Pandas deduping that reduces 25k events to ~400 then ~100 uniques, reliably surfacing ListBucket and ModifySnapshotAttribute outliers and a cross‑account STS token (ASIA) misuse case. Shows north/south S3 hunts using ASN and geo enrichment, recommends pre‑signed URLs, inventorying all S3‑capable IAM principals, removing unused S3 rights, and getting anomaly detection running within six months.
AI-written summary · about
chapters (16)
- 0:00Cloud exfiltration hunting intro
- 1:26Exfiltration problem and vectors
- 3:13Understanding CloudTrail log types and fields
- 9:44Enriching logs with geo and network data
- 13:03Reducing search space with AS data
- 15:10Combining detection methods
- 16:36Alerting on rare exfil events
- 17:20Detecting S3 north-south activity
- 20:15Why anomaly detection is needed
- 23:07Simple anomaly detection techniques
- 27:49Deduplication to cut costs
- 31:37ML anomaly detection
- 35:56Exfiltration event case study
- 41:16Early exfiltration disruption
- 44:31Predictive risk reduction
- 47:04Key takeaways
related talks
50mHunting Supply Chain Threats Using Anomaly Detection
40mMulti-Cloud Anomaly Detection: Finding Threats Among Us in the Big 3 Clouds
20mFantastic AWS Attacks and Where to Find Them
31mStreamlining Threat Hunting in Cloud Environments with Jupyter
28mPatterns for scalable security detections on AWS
43mThreat hunting in the cloud
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
16mLessons from the SOC: Analyzing and remediating cloud attack paths