Blank Space: Filling the Gaps in Atomic and Behavioral Cloud-Specific IoCs

No ratings

Presented at BSides SF 2025 by

Gili Tikochinski

Merav Bar

As cloud adoption grows, attackers exploit its unique attack surface. This talk explores atomic IOCs (e.g. IAM metadata, container IDs) and behavioral IOCs (e.g. API activity), featuring real-world examples like threat actor "Bapak" and insights to enhance cloud detection, hunting, and response.