Cloudy with a chance of IoCs

### Overview In "Cloudy with a chance of IoCs," presented at fwd:cloudsec, Zach Allen (Director of Security Detection and Research at Datadog) explores how cloud threat detection and cyber threat intelligence (CTI) intersect. He highlights the shortcomings of traditional indicator-of-compromise (IoC) feeds—such as IP address lists—when applied to cloud environments, and demonstrates a pipeline to transform AWS CloudTrail logs into structured MITRE ATT&CK Sightings formats to provide deeper context and implications.

### Key Topics - **Traditional Threat Intelligence Limitations**: Traditional CTI feeds often focus on low-level indicators like IP addresses and hashes (the base of the Pyramid of Pain). In cloud environments, flagging an IP as "malicious" lacks context, mechanism, implications, and actionable advice. - **Existing Intelligence Frameworks**: Established standards such as MISP (Malware Information Sharing Platform) Galaxy and the STIX framework (by OASIS) excel at showing relationships and host/network data, but currently lack cloud-specific taxonomies and control plane infrastructure coverage. - **MITRE ATT&CK Sightings Project**: Designed to remove cognitive biases from incident reports and analyses through structured reporting across three types: direct sighting of technique, direct sighting of software, and indirect sighting of software. Allen focuses on direct sightings of techniques. - **Contextual Enrichment in Cloud Logs**: AWS CloudTrail logs provide richer contextual information than raw network flow logs, including event names, AWS account IDs, access key IDs, user identities, and user agents.

### Technical Details - **Data Ingestion and Transformation with Vector**: Allen uses Vector, a lightweight ETL tool with a domain-specific language, to ingest raw AWS CloudTrail logs, filter noise, and transform entries into the MITRE ATT&CK Sightings JSON data model. - **Threat Emulation with Stratus Red Team**: To produce realistic attack data, Allen uses Stratus Red Team (created by Christophe), specifically testing the persistence attack `iam-create-admin-user`. This attack generated four separate API calls which Vector consolidated and reduced based on the user agent. - **Enrichment Table Mapping**: Vector utilizes an enrichment lookup table mapping approximately 60 AWS CloudTrail event names to corresponding MITRE ATT&CK technique IDs (leveraging documentation from Stratus Red Team and an Expel AWS mind map). For raw log fidelity, full CloudTrail log data was preserved inside the Sightings data model's `raw_data` field. - **Analysis with jq**: Allen demonstrated using `jq` to slurp sightings data, group records by software name (`stratus-red-team`), isolate technique IDs (such as persistence techniques), and filter out benign noise.

### Takeaways - **Move Up the Pyramid of Pain**: Security practitioners should prioritize detecting tools and TTPs (Tactics, Techniques, and Procedures) rather than relying exclusively on fragile, low-level indicators like hashes and IPs. - **Bridging the Advice Gap**: While MITRE ATT&CK Sightings helps capture context and technical implications, machine-readable formats do not automatically generate advice or mitigation strategy. Human analysts must provide the final layer of actionable guidance and interpretation. - **Extensibility**: While demonstrated on AWS CloudTrail, the architecture and methodology can be extended to other cloud platforms like Azure and GCP.