Trainer: Santiago Abastante

🗣  Inglés

🕒 Horario: a confirmar

📆 18 y 19 de mayo 2026 (2 días)

📍ON SITE Miami

Descripción general:

Cloud platforms like Amazon Web Services (AWS) are foundational to many critical
infrastructures and enterprise applications, making them prime targets for attackers. In this
session, we will not only explore the most relevant attack vectors cybercriminals use to
compromise AWS infrastructures but will also simulate these attacks using known threat actor
techniques in an adversary emulation context. From initial access to hardcore persistence, this
talk will provide a comprehensive look at how attackers operate in AWS environments.

We will take a technical journey through the tactics, techniques, and procedures (TTPs)
employed by attackers at every stage of the threat lifecycle, aligned with the MITRE ATT&CK
framework. We’ll start by reviewing common methods of initial access, such as exploiting
exposed credentials or vulnerabilities in services like IAM, Lambda, and EC2. From there, we’ll
detail how attackers escalate privileges, move laterally, and evade detection from tools like
CloudTrail.

The session will conclude with an in-depth look at advanced persistence techniques in AWS,
including the manipulation of IAM policies, backdooring Lambda functions or Docker containers,
and tampering with logs. Along the way, we’ll demonstrate how security teams can implement
defensive and detection strategies to mitigate these risks. By leveraging AWS-native services
and third-party tools, attendees will learn how to enhance their incident response capabilities.
This hands-on workshop will give attendees practical, technical insights into AWS security,
adversary behavior, and how to better defend against sophisticated, persistent attacks. A full
hands-on experience, this presentation ensures deep technical immersion.

This training is designed for security engineers, SOC analysts, incident responders, and
anyone who wants to truly understand AWS security through hands-on work. By the end
of the session, you’ll have a deep understanding on how real attack and defense
techniques work in AWS, being able to understand the hardening requirements, replicate
attacks, generate detection use cases, and execute forensic techniques.

Trainer: