Ryan Thompson

Silence of the Logs: Detecting Defense Impairment in AWS and Azure

This talk will walk through real-world defense impairment techniques across AWS and Azure. We'll dig into what it looks like when attackers suppress their own IPs in GuardDuty, redirect CloudTrail logs to buckets they control, tamper with Azure diagnostic settings, or disable Defender entirely.

Clearing the Fog: Detection and Defense Against AWS Persistence Techniques

This talk will cover persistence mechanisms specific to the AWS ecosystem. The audience will learn about well established persistence techniques but also about creative new mechanisms that rely on newer cloud services.