book

Threat Hunting in the Cloud

Name: Threat Hunting in the Cloud
ISBN: 9781119804062

by Chris Peiris, Binil Pillai, Abbas Kudrati

October 2021

Intermediate to advanced

544 pages

14h 7m

English

Wiley

Read now

Unlock full access

Cover
Title Page
Foreword
Introduction
What Does This Book Cover?Additional ResourcesHow to Contact the Publisher
Part I: Threat Hunting Frameworks
CHAPTER 1: Introduction to Threat Hunting
The Rise of CybercrimeWhat Is Threat Hunting?The Key Cyberthreats and Threat ActorsThe Necessity of Threat HuntingThreat ModelingThreat-Hunting Maturity ModelHuman Elements of Threat HuntingSummary
CHAPTER 2: Modern Approach to Multi-Cloud Threat Hunting
Multi-Cloud Threat HuntingBuilding Blocks for the Security Operations CenterCyberthreat Detection, Threat Modeling, and the Need for Proactive Threat Hunting Within SOCCyber Resiliency and Organizational CultureSkillsets Required for Threat HuntingThreat-Hunting Process and ProceduresMetrics for Assessing the Effectiveness of Threat HuntingThreat-Hunting Program EffectivenessSummary
CHAPTER 3: Exploration of MITRE Key Attack Vectors
Understanding MITRE ATT&CKThreat Hunting Using Five Common TacticsOther Methodologies and Key Threat-Hunting Tools to Combat Attack VectorsAnalysis ToolsSummary
Part II: Hunting in Microsoft Azure
CHAPTER 4: Microsoft Azure Cloud Threat Prevention Framework
Introduction to Microsoft SecurityUnderstanding the Shared Responsibility ModelMicrosoft Services for Cloud Security Posture Management and Logging/MonitoringUsing Microsoft Secure and Protect FeaturesMicrosoft Detect ServicesDetecting “Privilege Escalation” TTPsDetecting Credential AccessDetecting Lateral MovementDetecting Command and ControlDetecting Data ExfiltrationMicrosoft Investigate, Response, and Recover FeaturesUsing Machine Learning and Artificial Intelligence in Threat ResponseSummary

CHAPTER 5: Microsoft Cybersecurity Reference Architecture and Capability Map
IntroductionMicrosoft Security Architecture versus the NIST Cybersecurity Framework (CSF)Microsoft Security ArchitectureUsing the Microsoft Reference ArchitectureUnderstanding the Security Operations SolutionsUnderstanding the People Security SolutionsSummary
Part III: Hunting in AWS
CHAPTER 6: AWS Cloud Threat Prevention Framework
Introduction to AWS Well-Architected FrameworkAWS Services for Monitoring, Logging, and AlertingAWS Protect FeaturesAWS Detection FeaturesHow Do You Detect Privilege Escalation?How Do You Detect Credential Access?How Do You Detect Lateral Movement?How Do You Detect Command and Control?How Do You Detect Data Exfiltration?How Do You Handle Response and Recover?SummaryReferences
CHAPTER 7: AWS Reference Architecture
AWS Security Framework OverviewAWS Reference ArchitectureSummary
Part IV: The Future
CHAPTER 8: Threat Hunting in Other Cloud Providers
The Google Cloud PlatformThe IBM CloudOracle Cloud Infrastructure SecurityThe Alibaba CloudSummaryReferences
CHAPTER 9: The Future of Threat Hunting
SummaryReferences
Part V: Appendices
APPENDIX A: MITRE ATT&CK Tactics
APPENDIX B: Privilege Escalation
APPENDIX C: Credential Access
APPENDIX D: Lateral Movement
APPENDIX E: Command and Control
APPENDIX F: Data Exfiltration
APPENDIX G: MITRE Cloud Matrix
Initial AccessPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionData ExfiltrationImpact
APPENDIX H: Glossary
Index
Copyright
Dedication
About the Authors
About the Technical Editors
Acknowledgments
End User License Agreement

Content preview from Threat Hunting in the Cloud

Index

2FA (Two Factor Authentication), 78

A
AAD (Azure AD), 113–114, 157
- B2B, 215
- B2C, 215
- Conditional Access, 210–211
- Domain Services, 114
- External Identities, 115–116
- Identity Governance, 215–216
- Identity Protection, 114, 212–213
- Kerberos/NTLM authentication, 114
- LDAP (Lightweight Directory Access Protocol), 114
- PIM (Privilege Identity Management), 114, 213–214
  - audit history, 157
- Zero Trust Access Architecture, 113
access control
- application access tokens, 462–463
- AWS IAM (Identity and Access Management), 337–338
- AWS RAM (Resource Access Manager), 351–353
- Azure
  - conditional access, 123–127
- Conditional Access, 210–211
- Credential Access, 73–74
  - application access tokens, stealing, 462–463
  - brute force, 461
  - detection, 270
  - TTP detection, 137–139
  - unsecured credentials, 464
  - web credential forgery, 462
  - web session cookie stealing, 463–464
- CSF, 324
- GCP (Google Cloud Platform)
  - Access Approval API, 380
  - Cloud Identity & Access Management, 377, 378, 382
  - Context Aware Access, 378
- Initial Access
  - drive-by compromise, 447–450
  - phishing, 450–451
  - public-facing application exploit, 450
  - trusted relationship, 451
  - valid accounts, 452
- Initial Access TTP protection, 116–118
- LDAP (Lightweight Directory Access Protocol), 114
- Microsoft 365 Security, 187
- unauthorized access detection, 277–280
- Zero Trust Access Architecture, 113
account creation, 453
active defense, 28
AD (Active Directory), 456, 458
Advanced eDiscovery, 223–224
adversary, 479
AI (artificial intelligence), 479
- deep ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781119804062Purchase Link

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Threat Hunting in the Cloud

by Chris Peiris, Binil Pillai, Abbas Kudrati

Index

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.