The Hole in Your SOC: How a compromise of your SIEM could
summary
Shows how full SIEM access gives an attacker instant target maps, credentials and cloud keys by parsing firewall, DHCP and web logs and Windows event IDs (e.g. 4624, 4769, 4688), finds public S3 buckets and AWS console single‑factor logins, and exposes Ansible mistakes (an Ansible no_log leak example) plus SQL and proxy logs. Demonstrations include SPL queries to extract subnets, hostnames and service accounts, explains impact (data theft, pivoting, deletion, mass alerting) and gives concrete mitigations: MFA, tighten permissions, audit queries, and sanitize logs.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 2:00Agenda
- 5:24Three Mics
- 8:31Objectives
- 10:36Why attack a SIEM
- 12:42SIEM is not immune to compromise
- 13:58Musics Law
- 15:05Target Mapping
- 18:56Destination Ports
- 21:16Hardware OS Cloud Information
- 24:16Using Firewall Logs
- 31:05Identifying Individual Vulnerabilities
- 34:34Windows Locking Level
- 35:35End Goal
- 40:48Search History
- 41:00How to use the SIEM
- 44:21What can you do
- 45:34Takeaways
- 46:39Thank you
- 47:04Questions and answers
related talks
22mThe Hidden Access Paths to Smaugs Cavern
30mModern SOC:Less Than One and More Than Infinity
24mThe CSOs myopia
40mHow to Ruin your SOC in 5 Easy Steps
16mLessons from the SOC: Analyzing and remediating cloud attack paths
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
57mSomething Something Security
07mDon't Go There! Horrible Devops Security Blunders