Blank Space: Filling the Gaps in Atomic and...
summary
Claim: cloud-specific atomic and behavioral IoCs let defenders detect and link attacks that evade IP/hash/domain lists. Method: a honeypot that seeds leaked keys, log and pivot scans for API call sequences, and a public GitHub IOC repo. Surprises: a malicious image no-hapu/pause is pulled >10,000 times and 0.5% of public Terraform modules contain risky blocks. Concrete signals include get-caller-identity → describe-subnets → describe-instances, APEC AES DFG SSH key reuse, and create-cluster named bapak, and the pipeline successfully finds Bapak activity across real environments.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:03What are IoCs
- 2:25Cloud threat landscape
- 3:10Traditional atomic IoCs
- 4:12Cloud-specific atomic IoCs
- 11:23Behavioral indicators
- 15:41Case study Bapak
- 21:06Challenges and solutions
- 23:57Public IoC repository
- 25:02Q&A session
related talks
50mThe Anatomy of Cloud Attacks
41mIdentifying and Mitigating Cloud and Container Threats
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting
39mReal-World Detection Evasion Techniques in the Cloud
48mLateral Movement in the Age of Hybrid Cloud
44mLive Hacking Cloud Architectures
28mWhere Are All of the Container Breaches?
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions