Canary in the Cloud Mine: Stealthy Tripwires to Detect Post-Breach Activity
No ratings
Presented at RSAC 2025 by
Advanced and evolving cloud attacks (Blizzard) make breach seem inevitable. This session describes a deception detection approach using canaries, with a bit of honey and razors, to implement stealthy tripwires to provide low-FP detections for post-breach lateral movement and privilege escalation. Attendees will take away techniques to apply to their environments and security tools.