Threat Hunting in the Cloud: Defending AWS, Azure and Other Cloud Platforms Against Cyberattacks

Introduction

• What Does This Course Cover?
• Additional Resources

Introduction to Threat Hunting

• The Rise of Cybercrime
• What Is Threat Hunting?
• The Key Cyberthreats and Threat Actors
• The Necessity of Threat Hunting
• Threat Modeling
• Threat-Hunting Maturity Model
• Human Elements of Threat Hunting
• Summary

Modern Approach to Multi-Cloud Threat Hunting

• Multi-Cloud Threat Hunting
• Building Blocks for the Security Operations Center
• Cyberthreat Detection, Threat Modeling, and the Need for Proactive Threat Hunting Within SOC
• Cyber Resiliency and Organizational Culture
• Skillsets Required for Threat Hunting
• Threat-Hunting Process and Procedures
• Metrics for Assessing the Effectiveness of Threat Hunting
• Threat-Hunting Program Effectiveness
• Summary

Exploration of MITRE Key Attack Vectors

• Understanding MITRE ATT&CK
• Threat Hunting Using Five Common Tactics
• Other Methodologies and Key Threat-Hunting Tools to Combat Attack Vectors
• Analysis Tools
• Summary

Microsoft Azure Cloud Threat Prevention Framework

• Introduction to Microsoft Security
• Understanding the Shared Responsibility Model
• Microsoft Services for Cloud Security Posture Management and Logging/Monitoring
• Using Microsoft Secure and Protect Features
• Microsoft Detect Services
• Detecting  “Privilege Escalation”  TTPs
• Detecting Credential Access
• Detecting Lateral Movement
• Detecting Command and Control
• Detecting Data Exfiltration
• Microsoft Investigate, Response, and Recover Features
• Using Machine Learning and Artificial Intelligence in Threat Response
• Summary

Microsoft Cybersecurity Reference Architecture and Capability Map

• Introduction
• Microsoft Security Architecture versus the NIST Cybersecurity Framework (CSF)
• Microsoft Security Architecture
• Using the Microsoft Reference Architecture
• Understanding the Security Operations Solutions
• Understanding the People Security Solutions
• Summary

AWS Cloud Threat Prevention Framework

• Introduction to AWS Well-Architected Framework
• AWS Services for Monitoring, Logging, and Alerting
• AWS Protect Features
• AWS Detection Features
• How Do You Detect Privilege Escalation?
• How Do You Detect Credential Access?
• How Do You Detect Lateral Movement?
• How Do You Detect Command and Control?
• How Do You Detect Data Exfiltration?
• How Do You Handle Response and Recover?
• Summary
• References

AWS Reference Architecture

• AWS Security Framework Overview
• AWS Reference Architecture
• Summary

Threat Hunting in Other Cloud Providers

• The Google Cloud Platform
• The IBM Cloud
• Oracle Cloud Infrastructure Security
• The Alibaba Cloud
• Summary
• References

The Future of Threat Hunting

• Artificial Intelligence and Machine Learning
• Advances in Quantum Computing
• Advances in IoT and Their Impact
• Operational Technology (OT)
• Blockchain
• Threat Hunting as a Service
• The Evolution of the Threat-Hunting Tool
• Potential Regulatory Guidance
• Summary
• References

APPENDIX A: MITRE ATT&CK Tactics

APPENDIX B: Privilege Escalation

APPENDIX C: Credential Access

APPENDIX D: Lateral Movement

APPENDIX E: Command and Control

APPENDIX F: Data Exfiltration

APPENDIX G: MITRE Cloud Matrix

• Initial Access
• Persistence
• Privilege Escalation
• Defense Evasion
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Data Exfiltration
• Impact