Detection Challenges in Cloud-Connected Credential Attacks
Rod Soto explores the telemetry gaps and detection challenges facing defenders when threat actors abuse SSO and cloud credentials across hybrid perimeters.
Summary
The Blurring Perimeter in Cloud-Connected Enterprises
As enterprise identities span on-premises directories and SaaS applications, traditional network perimeters dissolve into distributed identity exchanges.
Dissecting Cloud Credential Access and Replay Attacks
Rod Soto examines advanced credential attacks—including session cookie hijacking, federated SAML token forging, and cloud API key exfiltration.
Telemetry Blindspots in Cloud Audit Logging
Soto details common visibility gaps across cloud provider logs, illustrating how adversaries evade detection by throttling API calls and leveraging legitimate management consoles.
Designing Resilient Identity Detection Pipelines
The author provides behavioral detection rules (Sigma, Splunk queries) to detect impossible travel, anomalous user-agent strings, and sudden IAM policy modifications.
Related talks
ICS Village·22 min
Otis Alexander
Otis Alexander analyzes the MITRE ATT&CK Evaluations for ICS, demonstrating why detection context and operational telemetry are vital for industrial defense.
Briefings·40 min
Olaf Hartong
What if you could leverage Event Tracing for Windows (ETW) to manipulate telemetry data, challenging the trust placed in endpoint detection and response (EDR) tools.
x33fcon·43 min
12. Guillaume Couchard & Erwan Chevalier: Leveraging Landlock telemetry for Linux detection enginee.
Security researchers examine technical aspects of 12. Guillaume Couchard & Erwan Chevalier: Leveraging Landlock telemetry for Linux detection enginee..