BSides Las Vegas 2026 — speaker not captured

Slide: Standard cloud exploitation on AWS diagramming a path from EC2 through roles, Lambda and Secrets Manager to AdminAccess and IAM, then across accounts to organisation compromise Slide: Standard cloud exploitation on AWS shown from the room, tracing initial account to production account to IAM routing and organisation compromise Slide: Azure, O365, SharePoint or OneDrive described as all connected and all the same, shown from the back of the session room Slide: Azure, O365, SharePoint or OneDrive tracing app IDs and Key Vault through SharePoint and OneDrive to on-premise targets, noting credentials found there can be reused internally Slide: Why attackers target EDR consoles — deployed on every endpoint including domain controllers, RCE as a feature, and internet-facing cloud hosting — under the line an unsecured defense tool is an attack tool Slide: When defense tools become attack tools, breaking IAM failure into process, design and monitoring — ticket auto-validation, managing Tier 0 with Tier 1, and bystander effect with alerts Slide: Tiers 0 is not limited to Active Directory, recommending an extended Tier 0 covering CI/CD, cloud, IAM and EDR consoles, tiering models on transversal applications, and production segregation
1 / 7

A cloud attack-path talk with a defensive argument underneath it: the tools you bought to defend the estate are the fastest route through it.

Photos only — this session was not recorded, and I did not catch the speaker’s name or the full talk title. “Weaponizing Cloud” is the running header on the deck.

AWS: Initial Access to Organisation Compromise

Slide: Standard cloud exploitation on AWS diagramming a path from EC2 through roles, Lambda and Secrets Manager to AdminAccess and IAM, then across accounts to organisation compromise via IAM Roles Anywhere

The chain is unglamorous and effective. A foothold on EC2 gives a role. The role reaches Lambda and Secrets Manager. Those give AdminAccess and IAM in the initial account.

IAM is then the routing layer: assume a role into the production account, repeat the EC2/Lambda/IAM pattern, collect AdminAccess again. From there the path runs through an admin user, access keys and MFA, and out to the organisation — and once the organisation management account is compromised, every other AWS account follows.

Azure, O365, SharePoint and OneDrive Are One System

Slide: Azure, O365, SharePoint or OneDrive described as all connected and all the same, tracing app IDs and Key Vault through SharePoint and OneDrive to on-premise targets

The subtitle does the work: they are all connected, they are all the same. An app ID leads to a subscription, a subscription to Key Vault, Key Vault to another app ID, and from there into SharePoint, Teams and Outlook.

The step worth noting is the pivot back on-premise. Everything sitting in SharePoint and OneDrive makes it much easier to identify which specific users hold high privileges on internal applications — and once you have their credentials, you reuse them inside.

When Security Tools Help the Attacker

Slide: Why attackers target EDR consoles — deployed on every endpoint including domain controllers, RCE as a feature, and internet-facing cloud hosting — under the line an unsecured defense tool is an attack tool

Three properties make the EDR console an attractive target, and all three are properties of it working correctly:

  1. Deployed on every endpoint, domain controllers included. Compromise the console and you reach most of the estate.
  2. RCE as a feature. The console can usually execute arbitrary code on managed hosts. That is pre-deployed command and control, already trusted, already everywhere.
  3. Reachable from the internet. Consoles are commonly cloud-hosted, so once compromised they are also persistence.

An unsecured defense tool is an attack tool.

Centralizing IAM: A Good Idea Until It Isn’t

Slide: When defense tools become attack tools, breaking IAM failure into process, design and monitoring — ticket auto-validation, managing Tier 0 with Tier 1, and bystander effect with alerts

Three failure classes, one per layer:

  • Process — ticket auto-validation. Anyone able to modify a role can grant privileges to that role, so auto-validation becomes privilege escalation. IAM turns into the quiet way to elevate.
  • Design — managing Tier 0 with Tier 1. If the IAM platform manages Tier 0 roles, its administrators are Tier 0 users. Compromising one leads to full AD compromise, and the tiering model is gone.
  • Monitoring — the bystander effect. IAM tools send validation alerts to a generic mailbox. Twenty people receive it, everyone acknowledges, nobody raises an incident.

Extended Tier 0

Slide: Tiers 0 is not limited to Active Directory, recommending an extended Tier 0 covering CI/CD, cloud, IAM and EDR consoles, tiering models on transversal applications, and production segregation

The remediation follows directly. Tier 0 is not an Active Directory concept — it is whatever can reach Tier 0.

  • Assess every application that can reach Tier 0 and build an extended Tier 0 from it. CI/CD, cloud, IAM and EDR consoles are the main entry points and compromise accelerators.
  • Deploy tiering models on transversal applications and environments, not just the directory.
  • Segregate production from preproduction, and make sure no application lets a user bypass the network segmentation you think you have.

Frequently Asked Questions

How does an AWS compromise escalate from one account to the whole organisation?

A foothold on EC2 leads to a role, which reaches Lambda and Secrets Manager, which yields AdminAccess and IAM in the initial account. IAM is then used to route into other accounts, repeating the pattern, and eventually to reach the organisation management account — from which every other AWS account is reachable.

Why do attackers target EDR consoles?

Three reasons: the agent is deployed on nearly every endpoint including domain controllers, so console compromise reaches most of the estate; the console can usually execute arbitrary code on managed hosts, which makes it a pre-deployed command-and-control channel; and consoles are often cloud-hosted and reachable from the internet, so they double as persistence.

How can a centralized IAM platform become an attack tool?

Through process, design and monitoring failures — ticket auto-validation lets anyone who can modify a role grant privileges to themselves, using Tier 1 tooling to manage Tier 0 roles makes IAM admins effectively Tier 0, and validation alerts sent to a generic mailbox produce a bystander effect where everyone acknowledges and nobody escalates.

What is an extended Tier 0?

The idea that Tier 0 is not limited to Active Directory. Any application that can reach Tier 0 belongs in it — CI/CD, cloud, IAM and EDR consoles are named as the main entry points and compromise accelerators.

Back to BSides Las Vegas 2026 — All Talks