mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
33 lines
4.9 KiB
Markdown
33 lines
4.9 KiB
Markdown
---
|
|
title: Cloud Security
|
|
layout: tag
|
|
author_profile: false
|
|
taxonomy: Cloud Security
|
|
permalink: /stories/cloud_security/
|
|
sidebar:
|
|
nav: "stories"
|
|
---
|
|
|
|
| Name | Technique | Tactic |
|
|
| ----------- | ----------- |--------------|
|
|
| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [AWS Network ACL Activity](/stories/aws_network_acl_activity/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [AWS Security Hub Alerts]() | None | None |
|
|
| [AWS User Monitoring](/stories/aws_user_monitoring/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
|
|
| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation/) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
|
|
| [Dev Sec Ops](/stories/dev_sec_ops/) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) |
|
|
| [GCP Cross Account Activity](/stories/gcp_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
|
|
| [Kubernetes Sensitive Object Access Activity]() | None | None |
|
|
| [Office 365 Detections](/stories/office_365_detections/) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) |
|
|
| [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
|
|
| [Suspicious AWS Traffic]() | None | None |
|
|
| [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
|
|
| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) |
|
|
| [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | |