🔴 Google Cloud Incident Response Cheat Sheet

A visual lifeline designed to equip you with the crucial steps and resources needed to navigate a GCP security incident.

https://medium.com/google-cloud/google-cloud-incident-response-cheat-sheet-dfde9054ac16

(Use VPN to open from Russia)

#gcp

🔷 Azure Attack Paths

Post shedding some light on known attack paths in an Azure environment.

https://cloudbrothers.info/en/azure-attack-paths/

#azure

🔶 How least privilege leads to a false sense of security

A view on least privilege which proposes its application misleads us in a wrong sense of security.

https://www.robertdemeyer.com/post/ciem-part-1-how-least-privilege-leads-to-a-false-sense-of-security

#aws

🔴 Sys:All Google Kubernetes Engine Risk

The Orca Research Pod has discovered a risk in Google Kubernetes Engine (GKE) that would allow an attacker with any Google account to take over a Kubernetes cluster. You can also read the follow up blog post.

https://orca.security/resources/blog/sys-all-google-kubernetes-engine-risk/

#gcp

🔶 How Zurich Insurance Group built their Scalable Account Vending process using AWS Account Factory for Terraform

By adopting AWS Control Tower Account Factory for Terraform, Zurich were able to achieve the scalability, resilience and performance to support provisioning of a projected 3000+ accounts.

https://aws.amazon.com/ru/blogs/architecture/how-zurich-insurance-group-built-their-scalable-account-vending-process-using-aws-account-factory-for-terraform/

#aws

🔶 The curious case of DangerDev@protonmail.me

An AWS incident response story, including the techniques used by the threat actor.

https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me

#aws

🔴 GKE/Gmail vulnerability: notes and tips

Security researchers have discovered a new Google Kubernetes Engine misconfiguration that could allow attackers with a basic Gmail account to take control of a Kubernetes (k8s) cluster.

https://expel.com/blog/gke-gmail-vulnerability-notes-and-tips/

#gcp

🔷 Azure Arc as persistence technique: stealthier than one would think on Linux servers

Post analyzing how using Azure Arc as a persistence vector would work, and what kind of logs it would generate on the host.

https://safecontrols.blog/2023/10/25/azure-arc-as-persistence-technique-stealthier-than-one-would-think-on-linux-servers/

#azure

🔶 CIEM Part 2: Measure risk probability in IAM

Post that tries to classify IAM Roles or IAM User candidates for an attack.

https://www.robertdemeyer.com/post/ciem-part-2-measure-risk-probability-in-iam

#aws

🔴 Announcing general availability of Custom Org Policy to help tailor resource guardrails with confidence

Custom Organization Policies is now generally available. The powerful new extension to Org Policies can create granular resource policies to address cloud governance requirements.

https://cloud.google.com/blog/products/identity-security/announcing-custom-org-policy-to-help-tailor-resource-guardrails-with-confidence/

#gcp

🔶 CIEM Part 3: Mastering privilege management for developers

How to determine the right point in time to harden a role which results in guidance on where to invest your time.

https://www.robertdemeyer.com/post/ciem-part-3-mastering-privilege-management-for-developers

#aws

🔷 Azure HDInsight Privilege Escalation and Denial of Service Vulnerabilities

The Orca Security Research Pod discovered three vulnerabilities in Azure HDInsight that could lead to privilege escalation and denial of service.

https://orca.security/resources/blog/azure-hd-insight-vulnerabilities-privilege-escalation/

#azure

🔶 Conditional Love for AWS Metadata Enumeration

How would you feel if an attacker could read your AWS resource tags? Turns out they can!

https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/

#aws

🔶 New EKS Access Management and Pod Identity features: a security analysis

The Wiz research team unpacks the security implications of the new EKS access and identity management features and recommends best practices when using them.

https://www.wiz.io/blog/eks-cluster-access-management-and-pod-identity-security-recommendations

#aws

🔶🔷🔴 The Nine Lives of Commando Cat: Analysing a Novel Malware Campaign Targeting Docker

Commando Cat is a novel cryptojacking campaign exploiting Docker for Initial Access. The campaign deploys a credential stealer payload, targeting Cloud Service Provider credentials (AWS, GCP, Azure).

https://www.cadosecurity.com/the-nine-lives-of-commando-cat-analysing-a-novel-malware-campaign-targeting-docker/

#aws #azure #gcp

🔷 The Attackers Guide to Azure AD Conditional Access

Post showing why it is important to understand the Conditional Access policy evaluation process and how to find and exploit flaws in a policy design.

https://danielchronlund.com/2022/01/07/the-attackers-guide-to-azure-ad-conditional-access/

#azure

🔶 Fargate Is Not Firecracker

A common misconception that AWS never corrected anyone about.

https://justingarrison.com/blog/2024-02-08-fargate-is-not-firecracker/

#aws

🔶 (Almost) Every infrastructure decision I endorse or regret after 4 years running infrastructure at a startup

The author reviews infrastructure decisions over four years at a startup, covering successful choices and regrets, emphasizing AWS, EKS, managed services, automation, and the value of early adoption and GitOps.

https://cep.dev/posts/every-infrastructure-decision-i-endorse-or-regret-after-4-years-running-infrastructure-at-a-startup/

#aws

🔶 How to be IR Prepared in AWS

This blog aims to demystify AWS' sometimes complicated logging methods to help organizations prepare for when a security incident occurs, outlining which logs should be enabled for the purpose of incident investigations.

https://www.cadosecurity.com/how-to-be-ir-prepared-in-aws/

#aws

🔶 A few notes on AWS Nitro Enclaves: Images and attestation

The AWS Nitro Enclaves platform lacks thorough documentation and mature tooling. So the Trail of Bits team decided to do some deep research into it to fill in some of the documentation gaps and, most importantly, to find security footguns and offer some advice for avoiding them.

https://blog.trailofbits.com/2024/02/16/a-few-notes-on-aws-nitro-enclaves-images-and-attestation/

#aws

🔶 Detecting Manual AWS Actions: An Update!

An updated version of how to detect manual AWS actions from employees.

https://arkadiyt.com/2024/02/18/detecting-manual-aws-actions-an-update/

#aws