Blue Team | Hunting Cloud Persistence Without Malware

Value of the Information & Strength of the Argument

The talk provides valuable, actionable insights for blue teams, emphasizing real-world attack techniques and practical hunting methods. The speakers argue convincingly that modern attackers leverage legitimate cloud features, making detection challenging. They support their points with case studies and concrete examples, though the argumentation is more experience-based than rigorously data-driven. The value lies in the practical KQL queries and the layered hunting framework, which can be directly applied by SOC analysts.

The title accurately reflects the content, focusing on hunting cloud persistence without malware.

7/10

The talk provides practical, experience-based insights from senior security engineers, with references to real-world cases and MITRE ATT&CK. However, it lacks detailed technical depth and formal citations, and the presentation is high-level.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 00:00Introduction and definition of silent compromise
• 03:00Attack vectors: OAuth, service principals, token replay, API keys
• 07:00Hunting framework: identity, apps, mail, data layers
• 10:00Practical KQL queries for OAuth consent and token replay
• 13:00Case studies: Unit 42, CVE-2025-3928, Microsoft AI exposure
• 16:00Action plan: audit logs, app consent controls, automation, weekly hunts

• MITRE ATT&CK for Cloud — Referenced as a framework for mapping persistence techniques.
• Unit 42 — Mentioned in case study about AWS credential theft.
• CVE-2025-3928 — Referenced as a zero-day in Azure exploited for persistence.

• MITRE ATT&CK for Cloud — Aligns with the talk's emphasis on cloud-specific attack techniques.