Catch Me If You Can: Hunting Cloud Exfiltration Using Anomaly Detection

The talk opens with public cloud exfiltration cases from 2016 to 2021, several of which went unnoticed until a later retrospective response. The speaker argues that defenders struggle to separate attacker API activity from legitimate automation, because stolen credentials produce calls that look like ordinary work. Many of these intrusions need no endpoint foothold at all, only valid keys or tokens.

Using AWS CloudTrail as the main data source, the talk explains which events matter for exfiltration, such as bucket listing, snapshot sharing and database snapshot restores, and why enriching events with geography and network name helps. It demonstrates hunts built on new or rare combinations of user, service, action and network, along with error spikes and volume outliers, run in a notebook. One case examined an S3 request using temporary credentials from an unexpected network, which traced back to a web application design rather than an intruder.

The closing section covers early-warning signals, such as list-bucket calls that tend to precede bulk transfers, and the trade-offs of automatically interrupting access. The main takeaway is to combine conventional alerting with anomaly detection, keep noisy signals in hunting workflows rather than paging queues, and agree on response processes with the teams that depend on automation.