book

Threat Hunting in the Cloud

Name: Threat Hunting in the Cloud
ISBN: 9781119804062

by Chris Peiris, Binil Pillai, Abbas Kudrati

October 2021

Intermediate to advanced

544 pages

14h 7m

English

Wiley

Read now

Unlock full access

Cover
Title Page
Foreword
Introduction
What Does This Book Cover?Additional ResourcesHow to Contact the Publisher
Part I: Threat Hunting Frameworks
CHAPTER 1: Introduction to Threat Hunting
The Rise of CybercrimeWhat Is Threat Hunting?The Key Cyberthreats and Threat ActorsThe Necessity of Threat HuntingThreat ModelingThreat-Hunting Maturity ModelHuman Elements of Threat HuntingSummary
CHAPTER 2: Modern Approach to Multi-Cloud Threat Hunting
Multi-Cloud Threat HuntingBuilding Blocks for the Security Operations CenterCyberthreat Detection, Threat Modeling, and the Need for Proactive Threat Hunting Within SOCCyber Resiliency and Organizational CultureSkillsets Required for Threat HuntingThreat-Hunting Process and ProceduresMetrics for Assessing the Effectiveness of Threat HuntingThreat-Hunting Program EffectivenessSummary
CHAPTER 3: Exploration of MITRE Key Attack Vectors
Understanding MITRE ATT&CKThreat Hunting Using Five Common TacticsOther Methodologies and Key Threat-Hunting Tools to Combat Attack VectorsAnalysis ToolsSummary
Part II: Hunting in Microsoft Azure
CHAPTER 4: Microsoft Azure Cloud Threat Prevention Framework
Introduction to Microsoft SecurityUnderstanding the Shared Responsibility ModelMicrosoft Services for Cloud Security Posture Management and Logging/MonitoringUsing Microsoft Secure and Protect FeaturesMicrosoft Detect ServicesDetecting “Privilege Escalation” TTPsDetecting Credential AccessDetecting Lateral MovementDetecting Command and ControlDetecting Data ExfiltrationMicrosoft Investigate, Response, and Recover FeaturesUsing Machine Learning and Artificial Intelligence in Threat ResponseSummary

CHAPTER 5: Microsoft Cybersecurity Reference Architecture and Capability Map
IntroductionMicrosoft Security Architecture versus the NIST Cybersecurity Framework (CSF)Microsoft Security ArchitectureUsing the Microsoft Reference ArchitectureUnderstanding the Security Operations SolutionsUnderstanding the People Security SolutionsSummary
Part III: Hunting in AWS
CHAPTER 6: AWS Cloud Threat Prevention Framework
Introduction to AWS Well-Architected FrameworkAWS Services for Monitoring, Logging, and AlertingAWS Protect FeaturesAWS Detection FeaturesHow Do You Detect Privilege Escalation?How Do You Detect Credential Access?How Do You Detect Lateral Movement?How Do You Detect Command and Control?How Do You Detect Data Exfiltration?How Do You Handle Response and Recover?SummaryReferences
CHAPTER 7: AWS Reference Architecture
AWS Security Framework OverviewAWS Reference ArchitectureSummary
Part IV: The Future
CHAPTER 8: Threat Hunting in Other Cloud Providers
The Google Cloud PlatformThe IBM CloudOracle Cloud Infrastructure SecurityThe Alibaba CloudSummaryReferences
CHAPTER 9: The Future of Threat Hunting
SummaryReferences
Part V: Appendices
APPENDIX A: MITRE ATT&CK Tactics
APPENDIX B: Privilege Escalation
APPENDIX C: Credential Access
APPENDIX D: Lateral Movement
APPENDIX E: Command and Control
APPENDIX F: Data Exfiltration
APPENDIX G: MITRE Cloud Matrix
Initial AccessPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionData ExfiltrationImpact
APPENDIX H: Glossary
Index
Copyright
Dedication
About the Authors
About the Technical Editors
Acknowledgments
End User License Agreement

Content preview from Threat Hunting in the Cloud

CHAPTER 4Microsoft Azure Cloud Threat Prevention Framework

What's in This Chapter

Introduction to Microsoft Security
Understanding the Shared Responsibility Model
Microsoft Services for Cloud Security Posture Management and Logging/Monitoring
- Enabling Azure Security Center
- Enabling Azure Defender
- Enabling Azure Sentinel
Microsoft Secure and Protect Features
- How to use Azure Web Application Firewall to protect a website against “Initial Access” TTP
- How to use Microsoft Defender for Office 365 for protection against “Initial Access” TTP
- How to use Microsoft Defender Endpoint for protection against “Initial Access” TTP
- How to use Azure Conditional Access for protection against “Initial Access” TTP
Microsoft Detect Features
- Detecting privilege escalation
- Detecting credential access
- Detecting lateral movement
- Detecting command and control
- Detecting data exfiltration
Microsoft Respond and Recover Features
- Automating investigation and remediation with Microsoft Defender for Endpoint
- Using Microsoft Threat Expert support for remediation and investigation
- Automating Security Response with MCAS and Microsoft Flow
- How to perform an automated response using Azure Security Center
- Using Machine Learning and Artificial Intelligence in Threat Response
- Overview of Fusion Detection
- Overview of Azure Machine Learning

This chapter focuses on using Microsoft services for cloud threat protection in alignment with the MITRE ATT&CK framework and the NIST Cybersecurity framework. ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781119804062Purchase Link

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Threat Hunting in the Cloud

by Chris Peiris, Binil Pillai, Abbas Kudrati

CHAPTER 4Microsoft Azure Cloud Threat Prevention Framework

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.