Use Powershell Instead of the GUI for Better Results
27
Splunk Joins The Hunt!
28
Adversary - Successful Login
29
Adversary Geolocation
30
Create Hypothesis - Credential Stuffing
31
Mirroring Network Traffic-VTAP
32
Hosted Network Monitoring - Extra Hop
33
Current Hypothesis
34
Takeaways
35
Questions?
Description:
Explore effective cloud threat hunting tactics in this 45-minute RSA Conference talk by Sherri Davidoff and Matt Durrin from LMG Security. Dive into proactive detection and mitigation of attacks on cloud and hybrid environments, covering orchestration attacks, file synchronization poisoning, cross-tenant attacks, credential stuffing, and architectural flaws. Learn about honeyclouds, integrated monitoring, and behavioral analysis/AI. Discover cloud hacking tools for AWS and Microsoft environments, and gain insights into creating hypotheses, using AWS GuardDuty, and leveraging Splunk for threat hunting. Examine real-world scenarios, including anonymous threats, bucket listing, and geolocation of adversaries. Understand the importance of PowerShell over GUI for better results and explore hosted network monitoring solutions. Gain valuable takeaways to enhance your cloud security posture and protect against sophisticated cyber threats.