Building the Cross-Cloud Kill Chain: A DE's Playbook for AWS, Azure & GCP Detections

In this technical briefing from the DEF CON 33 Cloud Village, a detection engineer presents a practical operational playbook for building unified attack detection across AWS, Microsoft Azure, and Google Cloud Platform. Opening at 00:00, the speaker highlights the complexity detection teams face when monitoring disjointed log schemas across multiple cloud providers.

At 05:01, the session details log normalization strategies, demonstrating how to ingest and standardize AWS CloudTrail, GCP Cloud Audit Logs, and Azure Activity Logs into a cohesive monitoring framework. At 10:01, the presenter examines cross-cloud lateral movement techniques, showing how threat actors exploit federated IAM trust relationships, compromised CI/CD pipeline secrets, and shared Terraform state files to pivot between different cloud environments.

At 15:02, the talk focuses on identity enrichment, transforming raw user IDs and role ARNs into actionable operational context to cut alert fatigue. At 20:03, the speaker showcases practical Kusto Query Language (KQL) detection rules designed to catch credential access and unauthorized cross-cloud API interactions, concluding at 25:01 with strategies for automated SOC incident response. (AI summary — Gemini Flash)