VulnCon 2026 Workshop
From Telemetry to Tradecraft: Hunting Adversaries in Multi-Cloud

From Telemetry to Tradecraft: Hunting Adversaries in Multi-Cloud

This workshop has prerequisites

Participants are expected to prepare cloud accounts, virtualization software, and a compatible system environment before attending.

View ↓

As enterprises rapidly increase their adoption of multi-cloud ecosystems, this transformation has opened the door to a surge in adversarial activities targeting cloud infrastructures.

This workshop introduces a clear and practical threat-hunting approach designed for multi-cloud environments. It explains the challenges of securing different cloud platforms and highlights the common techniques and behaviors used by attackers targeting cloud ecosystems.

Attendees will learn how to spot cloud-focused attackers, create strong hunting hypotheses, and apply proactive detection methods across AWS, Azure, and GCP.

The workshop emphasizes the practical configuration of cloud-native services to enable centralized logging and monitoring across multiple cloud platforms, followed by hands-on threat-hunting exercises in a multi-cloud setting. It concludes with a live demonstration of an AI-driven, client-enabled threat-hunting scenario, showcasing how AI can enhance modern security operations and transform cloud defence capabilities.

Table of Content

01

Introduction to Multi-Cloud Infrastructure

  1. Architectural Design and Components of Multi-Cloud Environments
02

The Cloud Threat Landscape

  1. APT Groups Targeting Cloud Ecosystems
  2. Tactics, Techniques, and Procedures (TTPs) Used Against Multi-Cloud Environments
  3. Cloud Threat Matrix and Attack Mapping
03

Logging and monitoring overview of multi cloud infrastructure

  1. Designing an Effective Cross-Cloud Monitoring Framework
04

Hunting cloud targeted threats

  1. Building and Executing Cloud Threat Hunting Hypotheses
  2. Conducting Hunts for Adversaries Targeting Multi Cloud Infrastructures

AWS

  • Credential Exposure & Access Key Leakage
  • Abuse of IAM Roles for Lateral Movement
  • Privilege Escalation via Misconfigured IAM Policies
  • Unauthorized Permission & Policy Assignments
  • Defense Evasion through Monitoring & Logging Manipulation
  • Abuse of Compute Instance Credentials & Metadata Services
  • Cloud Storage Discovery & Data Exfiltration

Azure

  • Credential-Based Initial Access Techniques
  • Identity & Session Hijacking Attacks
  • Discovery of Externally Exposed Cloud Resources
  • Abuse of Misconfigured Administrative Privileges
  • Cross-Environment Lateral Movement
  • Hybrid Identity & Federation Abuse

GCP

  • Authenticated Cloud Resource Enumeration
  • Privilege Abuse from Over-Permissive Roles
  • Container & Kubernetes Workload Compromise
  • Serverless Function Abuse
  • Cloud Data Access & Exfiltration Techniques
05

AI Driven cloud investigation and detection

  1. Vision for Futuristic Hunting Strategies
  2. Human intelligence with AI
  3. Configuration and integration of AI into threat hunting operations.
  4. Demonstration

Attendees Takeaway

Practical investigation workflows and operational knowledge

Dedicated Threat Investigation Labs
Self-Hosted cloud Monitoring Integration
Hunting hypothesis and Curated documentation
Investigative Mind Maps
Defensive mindset to tackle complex cloud attacks

What to Expect

Hands-on exposure to cloud hunting and AI-assisted investigation

A demonstration of how efficiently multi cloud logging has been implemented
Understanding the fundamentals of Cloud Specific Threat Hunting
Hands-on practice in Hunting & Investigation
Developing and integrating AI client for Threat Hunting investigation

Prerequisite Note

Required environment setup before attending the workshop

  • A system with a minimum of 16GB RAM and either VMware or VirtualBox installed
  • Basic understanding of cloud concepts
  • Free-tier accounts for AWS, Azure and GCP
  • Note: A dedicated VM image will be shared with participants prior to the event.

Workshop Speakers

Experts & Mentors

Harisuthan S

Harisuthan S

Senior Security Engineer @ Renault Group

Harisuthan is a Security Engineer who thrives at the intersection of offense and defense, leveraging hands-on expertise in cloud security, threat hunting, digital forensics, and detection engineering to stay ahead of evolving threats.

From orchestrating purple team engagements and attack simulations to architecting scalable investigation methodologies, he brings a strategic and technical edge to securing enterprise and multi-cloud environments.

LinkedIn