Beyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
summary
Practical checklist and a working toolchain: an open-source framework Leonidas runs attacker TTPs as code against AWS, generates Sigma rules, and executes a full kill chain in the demo (creates IAM user, issues API keys, escalates to Admin, reads a secret), with about 40 test cases available. Key specifics: use control plane and service logs (CloudTrail, S3 object logs, Kubernetes audit), enable CloudTrail multi-region logging, codify detections in CI/CD and validate continuously via automated simulation.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:55Onpremise vs Cloud
- 3:15Threat actors
- 4:16Mindset shift
- 4:50Context
- 5:41Telemetry
- 7:22Telemetry with no context
- 10:05Pivoting between environments
- 11:00Data sources
- 11:42Control plane audit logs
- 12:47Service specific logs
- 13:43How to prioritize
- 14:20What are we looking for
- 16:50Mitre Attack
- 18:05Entry Points
- 22:07How do we start
- 24:26Where do we start
- 24:59Devops principles
- 26:23Bringing DevOps into detection
- 26:46Leonidas
- 27:40Alfie
- 28:18Documentation
- 28:40Demo
- 34:49Conclusion
- 35:36Next Steps
- 36:33Ensure Defenders Have Access
- 37:11Outro
related talks
30mBuilding Effective Attack Detection in the Cloud
20mFantastic AWS Attacks and Where to Find Them
46mAttacking AWS: The Full Cyber Kill Chain
43mThreat hunting in the cloud
39mPerils of the cloud
50mThe Anatomy of Cloud Attacks
13mA guide to strengthening your threat detection and response
16mLessons from the SOC: Analyzing and remediating cloud attack paths