Cloud and SaaS Attack Tactics by LUCR-3 Scattered Spider - Detection and Hunting Approaches

Explore a comprehensive conference talk that delves into the cloud-based tactics, techniques, and procedures (TTPs) employed by LUCR-3 (Scattered Spider) threat actor group. Led by Ian Ahl, SVP of Permiso's P0 Labs and former Mandiant Advanced Practices Lead with extensive incident response experience, learn about the sophisticated methods this group uses to breach cloud, identity, and SaaS environments. Follow the complete attack chain from initial access to mission completion, while gaining valuable insights into detection strategies, hunting methodologies, and a robust collection of security rules. Drawing from his decade of experience at Mandiant and background in the US Marine Corps, Ahl provides an expert analysis of this lesser-known aspect of LUCR-3's operations, equipping security professionals with practical knowledge to defend against these emerging threats.