Главная
Study mode:
on
1
Missed Opportunities
2
Roadmap
3
Finger Pointing
4
Lack of Visibility
5
Our Cloud Threat Simulation
6
AWS Cloud Hacking Toolkit
7
Microsoft Cloud Environment
8
Meet The Cloud Hacker
9
Instrumentation
10
An Anonymous Threat
11
Threat Hunting - Create Hypothesis
12
AWS Tools
13
Guard Duty - "Hacker" Operating System Alert
14
Alert Fatigue
15
Interview with Anna Demin
16
Hunting With Splunk
17
Getting Data Into Splunk
18
Alert! The Adversary Lists Buckets
19
Alert! The Adversary Checks Available Functions
20
The User Agent String: A Wealth of Information
21
Chained with...
22
The Meatballs Are Gone!
23
New Host Configuration
24
Microsoft Audit Log Search
25
Can You Trust Your Tools?
26
Use Powershell Instead of the GUI for Better Results
27
Splunk Joins The Hunt!
28
Adversary - Successful Login
29
Adversary Geolocation
30
Create Hypothesis - Credential Stuffing
31
Mirroring Network Traffic-VTAP
32
Hosted Network Monitoring - Extra Hop
33
Current Hypothesis
34
Takeaways
35
Questions?
Description:
Explore effective cloud threat hunting tactics in this 45-minute RSA Conference talk by Sherri Davidoff and Matt Durrin from LMG Security. Dive into proactive detection and mitigation of attacks on cloud and hybrid environments, covering orchestration attacks, file synchronization poisoning, cross-tenant attacks, credential stuffing, and architectural flaws. Learn about honeyclouds, integrated monitoring, and behavioral analysis/AI. Discover cloud hacking tools for AWS and Microsoft environments, and gain insights into creating hypotheses, using AWS GuardDuty, and leveraging Splunk for threat hunting. Examine real-world scenarios, including anonymous threats, bucket listing, and geolocation of adversaries. Understand the importance of PowerShell over GUI for better results and explore hosted network monitoring solutions. Gain valuable takeaways to enhance your cloud security posture and protect against sophisticated cyber threats.

Cloud Threat Hunting

RSA Conference
Add to list
0:00 / 0:00