Fight Stealth with Stealth: Detecting post-breach activity in the Cloud

No ratings

Presented at BSidesCharm 2025 by

Jenko Hwong

Advanced and evolving cloud attacks (Blizzard) make breach seem inevitable. We describe a deception detection approach using canaries, with a bit of honey and razors, to implement stealthy tripwires to provide low-FP detections for post-breach lateral movement and privilege escalation.