Lessons from the SOC: Analyzing and remediating cloud attack paths
summary
Rapid7 incident response investigates an AWS tenant where a root account compromise leads to 5 accounts compromised, harvested session tokens and a decrypted SSH key pair, creation of a SageMaker role and multiple Jupyter notebooks, and the establishment of 8 persistence user accounts before attackers spin up a Lightsail host likely used for phishing after querying GetSendQuota. A separate case shows automated tagging halts 104 r5.24xlarge crypto‑mining instances, cutting potential $9,000/day losses to $160 using InsightIDR, Velociraptor and Attack Path Analysis in InsightCloudSec.
AI-written summary · about
chapters (4)
- 0:00Introduction and context
- 2:22Analyzing a cloud breach
- 10:40Attack path analysis
- 13:00Automation and conclusion
related talks
50mInsights into New Supply Chain and Cloud-Identity Attacks
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
46mAttacking AWS: The Full Cyber Kill Chain
27mAnatomy of an AWS Account Cryptojack
18mSecuring cloud innovation: Lessons learned
36mIAM Confused: Decoding 8 Real World Cloud Identity Breaches
48mNine Cloud Security Reasons for Resting Breach Face
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches