Clearing the Fog: Detection and Defense against Cloud Persistence Techniques

The talk looks at how an attacker who already has a foothold in a cloud account keeps access over time, instead of running quick, noisy jobs. The focus is on control plane persistence in AWS, with Azure shown as a rough equivalent. Host-level tricks are set aside, and initial access is treated as a given, whether through an exposed instance, leaked keys, or a hijacked session.

The session moves from simple to advanced methods. Basic options include creating users, attaching policies or group membership, adding console logins to service accounts that only used API keys, and generating new access keys. Trust policies that let an outside account assume a role are another route, and Azure guest invitations serve a similar purpose. More involved examples cover launching an instance with an attacker-held SSH key and an added role, and a Lambda function that fires whenever a new role is created and grants the attacker's identity trust automatically. A Lambda function URL can then act as a simple command channel that lists users or creates keys on request.

For detection, the speaker maps each technique to its specific API events, noting that the same calls are also the permissions an attacker needs. Calls made from Lambda carry a recognizable user agent, and hunting depends on knowing what normal activity looks like in each environment. Takeaways include narrowing policies to the exact actions and resources needed, reviewing last-used data to trim excess access, and treating newer instance metadata protections as only partial coverage.