Keynote | Hacking the Cloud Like an APT

On-premises to cloud lateral movement should be one of the top techniques in a red teamer’s arsenal. Difficult to detect and pervasive in nature, these techniques attract the likes of APT groups like Nobellium who have increased their focus on abusing identity federation. Techniques like Golden SAML and AD FS skeleton keys provide threat actors the double-edged sword of combining both lateral movement and privilege escalation into a single technique – with the added benefit of leaving little trace in …

abusing ad fs apt apt groups arsenal cloud detect federation focus golden hacking identity identity federation keynote keys lateral movement nature saml skeleton techniques