#cloud

4 posts

Cloud Lateral Movement: The Techniques Your SOC Keeps Missing

Lateral movement moved to the cloud control plane. Each hop is individually authorized, so single-event rules miss the chain.

May 30, 2026 · 16 min read

#cloud #lateral-movement #sigma #detection-program

threat intel advanced T1078

Identity-First Attacks: The Kill Chain Defends Five Stages the Attacker Skips

The 2011 kill chain trains you to stop malware at the perimeter. Identity-first attackers skip five of its seven links and log in. What to defend instead.

May 15, 2026 · 14 min read

#identity #threat-landscape #cloud #lateral-movement

threat intel advanced T1552.005

Workload Identities Have a Home Address, So Watch Where They Get Used

Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host. Use from elsewhere is theft.

Apr 20, 2026 · 12 min read

#nhi #workload-identity #cloud #sigma

threat intel intermediate T1078.004

45 to 1: Non-Human Identities Are Your Biggest Detection Blind Spot

You have ~45 non-human identities per human, and the signals your detection runs on (MFA, impossible travel, login geo) don't exist for any of them.

Mar 15, 2026 · 16 min read

#nhi #identity #cloud #ai-agents