Demystifying Cloud Infrastructure Attacks

Overview: A Trustwave principal forensic investigator presents at FIRST Conference on cloud infrastructure attacks, walking through a composite incident based on real-world investigations.

Key Topics: How cloud attacks differ from traditional kill chains; shared platform APIs as attack surfaces; Azure AD Connect and pass-through authentication abuse; and password reset versus authentication bypass techniques.

Technical Details: The speaker reconstructs an attack chain where adversaries abuse hybrid identity configurations, leveraging AD Connect servers to authenticate against on-premises Active Directory while bypassing expected password reset triggers.

Takeaways: Cloud attacks exploit identity bridges between on-prem and cloud environments. Defenders must understand hybrid authentication flows and monitor AD Connect infrastructure as a critical attack path.