Elbsides 2025

In this technical, demo-driven session, we’ll explore the tactics and techniques attackers use to compromise infrastructures in Amazon Web Services (AWS), from initial access to achieving advanced persistence. Using known threat actor techniques in an adversary emulation approach, we’ll examine common attack vectors such as credential exploitation, privilege escalation, and lateral movement, along with advanced persistence methods that allow attackers to maintain control of compromised environments. Defensive and detection strategies will be highlighted, leveraging both AWS-native services and external tools, helping security teams strengthen their defenses. This session promises a practical, real-world experience for attendees.