RTV: Visibility In The Clouds by Ilia Rabinovich and Oleg Lerner

### Overview In this talk, Ilia Rabinovich and Oleg Lerner from Sygnia present Cloud Scout, an open-source tool designed to map and visualize attack paths across hybrid and multi-cloud environments. As organizations migrate traditional infrastructure to the cloud, threat actors exploit cross-platform connections, hybrid architectures, and expanding attack surfaces to pivot across environments and escalate privileges. The speakers introduce Cloud Scout to overcome visibility limitations inherent in existing siloed security tools by consolidating and correlating identity and asset data across on-premises, Azure, and AWS infrastructures.

### Key Topics - **Hybrid Cloud Threat Landscape:** Over the last two years, organizations have accelerated transitions to hybrid and multi-cloud setups, interconnecting multiple cloud vendors, CI/CD pipelines, and microservices. Threat actors exploit this complexity by spinning up malicious cloud applications, targeting CI/CD workflows, developing cloud-dedicated malware, and leveraging cloud attack surfaces to pivot into on-premises networks or other cloud environments. - **Siloed Tooling Limitations:** Existing open-source tools each address single-environment enumeration: BloodHound (by SpecterOps) focuses on on-premises environments, Stormspotter (by Microsoft) focuses on Azure, and awspx (by F-Secure Labs) focuses on AWS. Because these tools operate in separate databases, security teams previously had to manually consolidate data to identify cross-platform relationships. - **Cloud Scout Architecture and Capabilities:** Because BloodHound, Stormspotter, and awspx all rely on Neo4j graph databases, Cloud Scout merges their data into a single unified database. It provides three primary functions: 1. Connecting cross-platform entities (such as users, applications, roles, and services) based on corresponding attributes. 2. Identifying cross-platform attack paths that threat actors could leverage for lateral movement and privilege escalation. 3. Visualizing these complex, cross-platform attack paths within a single screen.

### Technical Details - **Entity Correlation:** Real-world hybrid environments share interconnected entities. For instance, on-premises Active Directory accounts synced to Azure Active Directory can be linked between BloodHound and Stormspotter nodes using their user security identifier (SID). Cloud Scout enriches node data to construct both trivial and complex relationships across platforms. - **Integration and Installation:** Cloud Scout is packaged as a plugin for BloodHound, downloadable from GitHub. Users install it by running a batch installation script. Once installed, BloodHound's interface displays additional UI buttons that handle the ingestion of data from the different frameworks and execute the logic needed to build cross-platform relations.

### Takeaways - Visibility into interconnected hybrid and multi-cloud systems is a critical gap for modern security teams. - Traditional assessment tools provide only fragmented views of specific environments, masking cross-platform lateral movement risks. - By uniting data from BloodHound, Stormspotter, and awspx into a single Neo4j database, Cloud Scout allows defenders to uncover non-trivial attack paths spanning on-premises networks and multiple cloud providers.