{"product_id":"aws-real-world-attack-analysis-threat-detection-in-the-cloud-in-ming-loh-wei-chea-ang-dcsgfall26","title":"AWS Real-World Attack Analysis: AI-Assisted Threat Detection in the Cloud - In Ming Loh \u0026 Wei Chea Ang - DCTFall26","description":"\u003cp dir=\"ltr\"\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cstrong\u003eName of Training\u003c\/strong\u003e\u003cspan\u003e\u003cstrong\u003e:\u003c\/strong\u003e AWS Real-World Attack Analysis: AI-Assisted Threat Detection in the Cloud\u003cbr\u003e\u003c\/span\u003e\u003cstrong\u003eTrainer(s)\u003c\/strong\u003e\u003cspan\u003e\u003cstrong\u003e:\u003c\/strong\u003e In Ming LOH \u0026amp; Wei Chea ANG\u003cbr\u003e\u003c\/span\u003e\u003cstrong\u003eDates\u003c\/strong\u003e\u003cspan\u003e\u003cstrong\u003e:\u003c\/strong\u003e \u003cmeta charset=\"utf-8\"\u003eOct 1-2, 2026\u003cbr\u003e\u003c\/span\u003e\u003cspan\u003e\u003cstrong\u003eTime: \u003c\/strong\u003e8.30am - 5.30pm\u003c\/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c\/span\u003e\u003cstrong\u003eVenue\u003c\/strong\u003e\u003cspan\u003e\u003cstrong\u003e:\u003c\/strong\u003e TBD\u003cbr\u003e\u003c\/span\u003e\u003cstrong\u003eEarly Bird Cost\u003c\/strong\u003e\u003cspan\u003e\u003cstrong\u003e: \u003c\/strong\u003e\u003c\/span\u003e\u003cspan\u003e$2,250 (w\/GST)\u003cbr\u003e\u003cmeta charset=\"utf-8\"\u003e \u003cstrong\u003eRegular Cost\u003c\/strong\u003e\u003cstrong\u003e: \u003c\/strong\u003e$2,700 (w\/GST)\u003cbr\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eShort Summary:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cmeta charset=\"utf-8\"\u003eThis comprehensive, hands-on course equips security teams with the practical skills to master AWS security services and CloudTrail analysis, moving beyond theory to effectively detect and respond to modern attack techniques like privilege escalation and data exfiltration. Attendees will leave with a robust security foundation and the proven ability to investigate and defend their AWS infrastructure, directly strengthening their organization's cloud security posture.\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eCourse Description: \u003c\/strong\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cmeta charset=\"utf-8\"\u003eThis course is designed to equip security teams with the essential knowledge and practical skills needed to safeguard their AWS environments from modern threats. Participants will gain a deep understanding of core AWS security services, common attack vectors, and the capabilities of AWS CloudTrail for effective threat detection and response. Through hands-on labs, students will begin by configuring fundamental AWS services like Identity and Access Management (IAM), Amazon Elastic Compute Cloud (EC2), and AWS CloudTrail, establishing a robust foundation for security monitoring.\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003eBuilding upon this foundation, participants will engage in various investigation scenarios, analyzing CloudTrail data to identify and investigate various attack techniques demonstrated by the instructor. This practical approach allows students to master the analysis of CloudTrail logs and uncover suspicious activity. They will learn to identify prevalent attack techniques, such as privilege escalation and data exfiltration.\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003eThis course empowers security professionals to build a robust security posture and effectively defend their AWS infrastructure against evolving threats.\u003cbr\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cspan\u003e\u003cmeta charset=\"utf-8\"\u003e \u003cstrong\u003eCourse Outline: \u003c\/strong\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eTopic 1: AWS Fundamentals (Day 1)\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eAWS Overview: Introducing the AWS core concept.\u003c\/li\u003e\n\u003cli\u003e\n\u003cmeta charset=\"utf-8\"\u003eHands on Configuration of AWS services such as IAM, EC2, Lambda, S3. This will provide the fundamental knowledge for the attendees before we cover how these services are abused by the threat actor.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eTopic 2: Introduction to AWS CloudTrail (Day 1)\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eCloudTrail Fundamentals: Learn the core concepts and functionalities of AWS CloudTrail.\u003c\/li\u003e\n\u003cli\u003eConfiguring CloudTrail: Master the process of setting up CloudTrail trails to capture relevant events and activities.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eTopic 3: CloudTrail Log Analysis (Day 1\/Day 2)\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eLog Interpretation: Develop the ability to decipher CloudTrail logs to identify user activities, API calls, and resource changes.\u003c\/li\u003e\n\u003cli\u003eThreat Detection: Learn to recognize indicators of compromise (IoCs), indicators of attack (IoA) and anomalies within CloudTrail logs.\u003c\/li\u003e\n\u003cli\u003eAdvanced Analysis Techniques: Explore methods for extracting actionable intelligence from CloudTrail data.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eTopic 4: Understanding the AWS Threat Landscape (Day 2)\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eCommon AWS Attack Vectors: Explore real-world attack scenarios, including unauthorized access and data exfiltration.\u003c\/li\u003e\n\u003cli\u003eThreat Actor Tactics: Analyze the techniques employed by malicious actors to target AWS environments, aligning them with the industry-standard MITRE ATT\u0026amp;CK Framework.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eTopics 5: AWS Attack Detection (Day 2)\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdvanced Threat Hunting with CloudTrail: Analyze attacker methodologies and tactics as captured in CloudTrail logs to understand the techniques used by adversaries, enabling you to proactively identify and counteract potential threats.\u003c\/li\u003e\n\u003cli\u003ePractical Tips for Effective CloudTrail-Based Threat Hunting: Learn proven best practices and actionable strategies to perform robust threat hunting with CloudTrail, ensuring you can efficiently monitor, detect, and respond to evolving cyber risks.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eDifficulty Level:\u003c\/strong\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eIntermediate - \u003c\/span\u003e\u003cspan\u003eThe student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eSuggested Prerequisites:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cb\u003e\u003c\/b\u003e\u003cmeta charset=\"utf-8\"\u003eParticipants are not required to have prior AWS knowledge. The training curriculum includes comprehensive coverage of AWS fundamentals, though any existing AWS and SOC experience will be beneficial.\u003cbr\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eWhat Students Should Bring:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli dir=\"ltr\"\u003e\n\u003cmeta charset=\"utf-8\"\u003eLaptop\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp dir=\"ltr\"\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cstrong\u003eWhat the Trainer Will Provide:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli dir=\"ltr\"\u003e\n\u003cmeta charset=\"utf-8\"\u003eOnline lab + Slides\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eTrainer(s) Bio:\u003c\/strong\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cstrong\u003eIn Ming LOH\u003c\/strong\u003e is a principal consultant at a prominent cybersecurity firm, specializing in incident response and technical assessment engagements with a strong emphasis on cloud environments. He has been instrumental in numerous high-profile investigations, involving both nation-state and e-crime threat actors across a wide array of industries.\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eWei Chea ANG \u003c\/strong\u003ecurrently works at a leading SaaS company, empowering enterprises to secure and manage their digital assets. For the past 7 years, he has specialized in cloud security, working with a diverse range of organizations from startups to Fortune 100 companies. His expertise has been shared at prestigious conferences, including HITCon, ISC2 APAC Congress, and FIRST APAC Symposium.\u003cstrong\u003e\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cstrong\u003eRegistration Terms and Conditions: \u003c\/strong\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eTrainings are refundable before Sept 1, 2026, minus a non-refundable processing fee of $350.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eBetween Sept 2, 2026 and Sept 28, 2026 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eAll trainings are non-refundable after Sept 28, 2026.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eTraining tickets may be transferred to another student. Please email us at training@defcon.org for specifics.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eIf a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eFailure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eDEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eBy purchasing this ticket you agree to abide by the \u003c\/span\u003e\u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003e\u003cspan\u003eDEF CON Training Code of Conduct\u003c\/span\u003e\u003c\/a\u003e\u003cspan\u003e and the registration terms and conditions listed above.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eSeveral breaks will be included throughout the day. Please note that food is not included.\u003c\/span\u003e\u003cspan\u003e\u003cb\u003e\u003c\/b\u003e\u003c\/span\u003e\u003c\/p\u003e\n\u003cp dir=\"ltr\"\u003e\u003cspan\u003eAll courses come with a certificate of completion, contingent upon attendance at all course sessions. Some courses offer an option to upgrade to a certificate of proficiency, which requires an additional purchase and sufficient performance on an end-of-course evaluation.\u003c\/span\u003e\u003c\/p\u003e","brand":"Singapore October 2026","offers":[{"title":"Course only - Oct 1-2","offer_id":51499658412172,"sku":null,"price":2250.0,"currency_code":"SGD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0750\/9042\/8044\/files\/InMing.jpg?v=1768361718","url":"https:\/\/sg.shop.defcon.org\/products\/aws-real-world-attack-analysis-threat-detection-in-the-cloud-in-ming-loh-wei-chea-ang-dcsgfall26","provider":"DEF CON SG","version":"1.0","type":"link"}