Inside Cloud Attack Paths: End-to-End Adversary Simulation
Mauricio Velazco
BSides NYC 2025 (0x05) · Day 1 · Tech - Red
In an increasingly cloud-centric world, traditional cybersecurity defenses are proving insufficient against evolving adversary tactics. Mauricio Velazco's talk, "Inside Cloud Attack Paths: End-to-End Adversary Simulation," at BSides NYC, illuminated a critical shift in the threat landscape: attackers are bypassing endpoint detection and response (EDR) solutions by directly targeting cloud APIs and abusing legitimate permissions. This paradigm shift necessitates a deeper understanding of **cloud attack paths**, which are chains of legitimate steps an adversary takes by leveraging compromised identities and existing entitlements to achieve a malicious objective, without exploiting zero-days or vulnerabilities.
AI review
Velazco delivers a competent, practitioner-focused session on Azure/Entra ID attack path simulation backed by two real open-source tools he built himself. The tooling is the actual contribution here — Batcher and MS Invader are genuinely useful — but the attack primitives being demonstrated (app registration ownership abuse, managed identity token theft, Key Vault secret chaining) are well-documented territory that BloodHound Enterprise, AzureHound, and the Secureworks/SpecterOps research corpus already cover in depth. Solid BSides content, but it would need substantially more novel attack…