Detecting Unauthorized Behavior From Legitimate Accounts

Incident Responders face an almost insurmountable amount of log events, and the move to the Cloud has only intensified this dependency on log data for intrusion analysis.Attackers are shifting techniques to utilize compromised accounts to hide their activity among the volume of legitimate business...

By

Rodney Caudle

June 22, 2022

All papers are copyrighted. No re-posting of papers is permitted

Related Content

ransomware 25 340x340.png

Digital Forensics, Incident Response & Threat Hunting, Cyber Defense, Offensive Operations, Pen Testing, and Red Teaming

Visual Summary of SANS Ransomware Summit 2025

Check out these graphic recordings created in real-time throughout the event for SANS Ransomware Summit 2025

Blog Teaser: Shoplifting2.0 340x340.jpg

Digital Forensics, Incident Response & Threat Hunting

Shoplifting 2.0: When it’s Data the Thieves Steal

Identify steps organisations can implement to protect against Scattered Spider and DragonForce

Adam Harrison

emerging threats summit 340x340.png

Digital Forensics, Incident Response & Threat Hunting, Offensive Operations, Pen Testing, and Red Teaming, Cyber Defense, Industrial Control Systems Security, Cybersecurity Leadership

Visual Summary of SANS Emerging Threats Summit 2025

Check out these graphic recordings created in real-time throughout the event for SANS Emerging Threats Summit 2025