Logs keep a lot of data. Most of them are events, but events have other data in them. Source IP, Source Identity, Target Resource, User Agent, Request and Response Parameters, etc. Which one of them are important? All of them of course. Logs are important to a defender. And they are a needle in the foot of the attacker. But why do they have to be? Why can't the attacker actually profit from logs? What if the attacker can achieve enumeration, C2 capabilities, exfiltration, download through logs?
This presentation will go through actually that. How can an attacker utilize Logs to attack a Cloud Infrastructure.