book

Threat Hunting in the Cloud

Name: Threat Hunting in the Cloud
ISBN: 9781119804062

by Chris Peiris, Binil Pillai, Abbas Kudrati

October 2021

Intermediate to advanced

544 pages

14h 7m

English

Wiley

Read now

Unlock full access

Cover
Title Page
Foreword
Introduction
What Does This Book Cover?Additional ResourcesHow to Contact the Publisher
Part I: Threat Hunting Frameworks
CHAPTER 1: Introduction to Threat Hunting
The Rise of CybercrimeWhat Is Threat Hunting?The Key Cyberthreats and Threat ActorsThe Necessity of Threat HuntingThreat ModelingThreat-Hunting Maturity ModelHuman Elements of Threat HuntingSummary
CHAPTER 2: Modern Approach to Multi-Cloud Threat Hunting
Multi-Cloud Threat HuntingBuilding Blocks for the Security Operations CenterCyberthreat Detection, Threat Modeling, and the Need for Proactive Threat Hunting Within SOCCyber Resiliency and Organizational CultureSkillsets Required for Threat HuntingThreat-Hunting Process and ProceduresMetrics for Assessing the Effectiveness of Threat HuntingThreat-Hunting Program EffectivenessSummary
CHAPTER 3: Exploration of MITRE Key Attack Vectors
Understanding MITRE ATT&CKThreat Hunting Using Five Common TacticsOther Methodologies and Key Threat-Hunting Tools to Combat Attack VectorsAnalysis ToolsSummary
Part II: Hunting in Microsoft Azure
CHAPTER 4: Microsoft Azure Cloud Threat Prevention Framework
Introduction to Microsoft SecurityUnderstanding the Shared Responsibility ModelMicrosoft Services for Cloud Security Posture Management and Logging/MonitoringUsing Microsoft Secure and Protect FeaturesMicrosoft Detect ServicesDetecting “Privilege Escalation” TTPsDetecting Credential AccessDetecting Lateral MovementDetecting Command and ControlDetecting Data ExfiltrationMicrosoft Investigate, Response, and Recover FeaturesUsing Machine Learning and Artificial Intelligence in Threat ResponseSummary

CHAPTER 5: Microsoft Cybersecurity Reference Architecture and Capability Map
IntroductionMicrosoft Security Architecture versus the NIST Cybersecurity Framework (CSF)Microsoft Security ArchitectureUsing the Microsoft Reference ArchitectureUnderstanding the Security Operations SolutionsUnderstanding the People Security SolutionsSummary
Part III: Hunting in AWS
CHAPTER 6: AWS Cloud Threat Prevention Framework
Introduction to AWS Well-Architected FrameworkAWS Services for Monitoring, Logging, and AlertingAWS Protect FeaturesAWS Detection FeaturesHow Do You Detect Privilege Escalation?How Do You Detect Credential Access?How Do You Detect Lateral Movement?How Do You Detect Command and Control?How Do You Detect Data Exfiltration?How Do You Handle Response and Recover?SummaryReferences
CHAPTER 7: AWS Reference Architecture
AWS Security Framework OverviewAWS Reference ArchitectureSummary
Part IV: The Future
CHAPTER 8: Threat Hunting in Other Cloud Providers
The Google Cloud PlatformThe IBM CloudOracle Cloud Infrastructure SecurityThe Alibaba CloudSummaryReferences
CHAPTER 9: The Future of Threat Hunting
SummaryReferences
Part V: Appendices
APPENDIX A: MITRE ATT&CK Tactics
APPENDIX B: Privilege Escalation
APPENDIX C: Credential Access
APPENDIX D: Lateral Movement
APPENDIX E: Command and Control
APPENDIX F: Data Exfiltration
APPENDIX G: MITRE Cloud Matrix
Initial AccessPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionData ExfiltrationImpact
APPENDIX H: Glossary
Index
Copyright
Dedication
About the Authors
About the Technical Editors
Acknowledgments
End User License Agreement

Content preview from Threat Hunting in the Cloud

About the Technical Editors

Sina Manavi is a cybersecurity evangelist and Senior Manager – Group Information Security Governance at AIA. Over the past decade, Sina has worked with different government agencies, in the banking and financial sectors, as well as for well-known companies such as EC Council in different roles, from penetration testing to threat hunting and intelligence, cyber incident response, data protection, third-party security, governance, risk and compliance, cloud security, and strategy planning and digital transition.

Sina also has been a regular keynote speaker at various conferences and webinars, supporting cybersecurity communities with the latest about the threat landscape. He has shared his knowledge and experience as a cybersecurity practitioner across the globe.

Sina started his career as a software developer and application security analyst while getting his B.Sc. in software engineering at Azad University Lahijan, Iran. After moving to Malaysia to get his Master of Computer science (Digital Forensics) at University Putra, Malaysia, Sina expanded his career to the next level. Due to his passion for teaching, he conducted penetration testing, secure code practice, digital forensics, incident response, and mobile security training for industry cybersecurity professionals.

Madanraj Sadasivam (Madan) is an enterprising leader and planner with a ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781119804062Purchase Link

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Threat Hunting in the Cloud

by Chris Peiris, Binil Pillai, Abbas Kudrati

About the Technical Editors

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.