Abstract: Techniques are described herein that are capable of detecting potential malicious use of a resource management agent using a resource management log. The resource management log is analyzed. The resource management log logs API requests that request that a resource management system cause the resource management agent to perform respective operations. An anomalous operation is detected among the operations based at least in part on an identified API request satisfying one or more criteria associated with anomalous behavior. The identified API request requests that the resource management system cause the resource management agent, which is loaded on a machine and which enables the resource management system to remotely manage resources associated with the machine, to perform the anomalous operation. An alert is generated to notify a user of the potential malicious use of the resource management agent based at least in part on detection of the anomalous operation.

Abstract: Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.

Abstract: The techniques disclosed herein prevent a rogue resource from being created within a cloud computing environment. For example, a rogue serverless function may be prevented from integrating with a cloud-based database, thereby preventing the serverless function from performing malicious operations such as low-rate data exfiltration. The rogue serverless function is detected before it is installed, heading off the attack completely. In some configurations, a key retrieval request is received. Parameters of the key retrieval request are analyzed for anomalies, and anomalous key retrieval requests are stored in a pool. Then, when a request to create a resource is received, the pool of anomalous key retrieval requests is searched for a match. When a match is found, the resource creation request may be suspended pending a further security review.

Abstract: A recovery instruction pertaining to a resource is detected. The recovery instruction is matched with a delete instruction that caused the resource to enter a soft-deleted. A mismatch between a first user account associated with the recovery instruction and a second user account associated with the delete instruction is determined. A mitigation action is performed based on determining the mismatch between the first user account and the second user account.

Abstract: Generally discussed herein are devices, systems, and methods for cloud resource security. A method can include receiving, at a monitor device and from a first cloud resource of cloud resources hosted by a cloud provider, a request for a token that uniquely identifies the first cloud resource, the request indicating a destination that is a metadata server. The method can include comparing, based on entries in an application programming interface (API) access log, the cloud provider associated with the first cloud resource and a cloud provider associated with the metadata server. The method can include responsive to the cloud provider of the first cloud resource being different from the cloud provider of the metadata server performing a security mitigation action.

Abstract: Mitigation of attack vectors that persist elevated permissions within a computing environment. Mitigated attack vectors may be configured to respond to a trigger by generating computing resources with a built-in vulnerability. Mitigated attack vectors may elevate permissions of the computing resources to some heightened level which the malicious actor had previously gained. For example, if the malicious actor had breached a user account having administrator privileges, the attack vector may respond to the trigger by creating the virtual machine and then linking the virtual machine to a service principal having the administrator-level permissions. Left unmitigated the attack vector would enable the malicious actor to regain “administrator-level” privileges even after access to the user account is halted.

Abstract: Generally discussed herein are devices, systems, and methods for improving cloud resource security. A method can include obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, the actions including entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed. The method can include determining a respective score for each action in the cloud resource management log, comparing the respective score to a specified criterion, and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.

Abstract: A computing system is configured to cause an agent to be installed at a cloud consumer computing system. The cloud consumer computing system is configured to access a cloud service. The agent is configured to scan at least a portion of storage of the cloud consumer computing system for a data pattern associated with a credential. In response to finding the data pattern associated with the credential, the agent sends the data pattern to the computing system. In response to receiving the data pattern, the computing system is configured to extract an identifier associated with the credential based on the data pattern, identify a scope of permission to which the identifier is granted, and mitigate a risk of potential exposure of the credential.

Abstract: A computing system is configured to access a cloud storage and make a copy of at least a portion of the cloud storage. The copy of the at least portion of the cloud storage to search for a data pattern associated with a credential. In response to finding the data pattern associated with the credential, the computing system extracts an identifier associated with the credential and a scope of permission that the identifier is granted to. The scope of permission is associated with a permission to access a cloud resource. Finally, a risk of potential exposure of the credential is mitigated, such as (but not limited to) notifying an owner of the cloud resource, deleting the credential from the cloud, or modifying or revoking the scope of permission associated with the credential.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect anomalous behavior with respect to control plane operations (e.g., resource management operations, resource configuration operations, resource access enablement operations, etc.). For example, a log that specifies an access enablement operation performed with respect to an entity is received. An anomaly score is generated indicating a probability whether the access enablement operation is indicative of anomalous behavior via an anomaly prediction model. A determination is made as to whether anomalous behavior has occurred with respect to the entity based at least on the anomaly score. Based on a determination that the anomalous behavior has occurred, a mitigation action may be performed that mitigates the anomalous behavior.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect mass control plane operations, which may be indicative of anomalous (or malicious) behavior. For example, one or more logs that specify a plurality of access enablement operations performed with respect to an entity is received. The log(s) are analyzed to identify a number of access enablement operations that occurred in a particular time period. A determination is made as to whether the identified number of access enablement operations meets a threshold condition (e.g., to determine whether an unusually high number of such operations occurred in a given time period). Based on the threshold condition being met, a determination is made that anomalous behavior has occurred with respect to the entity. Responsive to determining that the potentially behavior has occurred, a mitigation action may be performed that mitigates the behavior.

Abstract: Generally discussed herein are devices, systems, and methods for improving cloud resource security. A method can include obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, the actions including entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed. The method can include determining a respective score for each action in the cloud resource management log, comparing the respective score to a specified criterion, and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.

Abstract: According to examples, an apparatus may include machine-readable instructions that may cause the processor to determine that a first malware was detected on a first computing device and to determine whether a second malware was detected on a second computing device within a predefined period of time of when the first malware was detected on the first computing device, in which the first computing device and the second computing device are associated with a shared data storage that is remote from the first and second computing devices. The instructions may also cause the processor to, based on a determination that the second malware was detected within the predefined period of time, output a notification that the first malware was likely spread to the first computing device and/or that the second malware was likely spread to the second computing device through the shared data storage.

Abstract: An indication is received of a security alert. The indication is generated based on a detected anomaly in one of a data plane or a control plane of a computing environment. When the detected anomaly is in the data plane, the control plane is monitored for a subsequent anomaly in the control plane, and otherwise the data plane is monitored for a subsequent anomaly in the data plane. A correlation between the detected anomalies is determined. A notification of the security alert is sent when the correlation exceeds a predetermined threshold.

Abstract: According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to receive a request to upload a file to a directory and determine whether the request is a request to upload a predefined type of file to the directory. In addition, based on a determination that the request is a request to upload the predefined type of file to the directory, the processor may determine, through application of a predictive model, whether the directory is a user content directory and based on a determination that the application of the predictive model indicates that the directory is a user content directory, block the request and/or output a notification regarding the receipt of the request.

Abstract: Techniques are described herein that are capable of detecting potential malicious use of a resource management agent using a resource management log. The resource management log is analyzed. The resource management log logs API requests that request that a resource management system cause the resource management agent to perform respective operations. An anomalous operation is detected among the operations based at least in part on an identified API request satisfying one or more criteria associated with anomalous behavior. The identified API request requests that the resource management system cause the resource management agent, which is loaded on a machine and which enables the resource management system to remotely manage resources associated with the machine, to perform the anomalous operation. An alert is generated to notify a user of the potential malicious use of the resource management agent based at least in part on detection of the anomalous operation.

Abstract: Generally discussed herein are devices, systems, and methods for improving cloud resource security. A method can include obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, the actions including entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed. The method can include determining a respective score for each action in the cloud resource management log, comparing the respective score to a specified criterion, and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.

Abstract: According to examples, an apparatus may include machine-readable instructions that may cause the processor to determine that a first malware was detected on a first computing device and to determine whether a second malware was detected on a second computing device within a predefined period of time of when the first malware was detected on the first computing device, in which the first computing device and the second computing device are associated with a shared data storage that is remote from the first and second computing devices. The instructions may also cause the processor to, based on a determination that the second malware was detected within the predefined period of time, output a notification that the first malware was likely spread to the first computing device and/or that the second malware was likely spread to the second computing device through the shared data storage.

Abstract: According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to receive a request to upload a file to a directory and determine whether the request is a request to upload a predefined type of file to the directory. In addition, based on a determination that the request is a request to upload the predefined type of file to the directory, the processor may determine, through application of a predictive model, whether the directory is a user content directory and based on a determination that the application of the predictive model indicates that the directory is a user content directory, block the request and/or output a notification regarding the receipt of the request.

Abstract: Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.