Mitiga Labs

Tag Your Way In: New Privilege Escalation Technique in GCP

GCP offers fine-grained access control using Identity and access management (IAM) Conditions, allowing organizations to restrict permissions based on context like request time, resource type and resource tags.

Ariel Kalman

GCP Service Agents & Workload Identities in Cloud Audit Logs: A Forensic Guide

Identify GCP service agents, workload identities, and GKE access in Cloud Audit Logs — a forensic guide to who (and what) accessed your Google Cloud project.

Gavriel Fried

Rippling Turning Into a Tsunami: Insider Threats in SaaS Environments

Rippling's breach reveals the urgent need for threat detection in SaaS. Learn how to identify insider threats across platforms like Slack and Google Drive.

Uncovering Hidden Threats: GitHub Threat Hunting for Non-Human Identities

Learn GitHub threat hunting tactics to detect non-human identity risks, exposed secrets, and OAuth abuse in CI/CD pipelines.

Hunting Conditional Access Policy Bypass in the Wild: Leveraging Malicious Browser Extensions for Seamless Initial Access

How attackers bypass Conditional Access using malicious browser extensions — a Mitiga threat hunt with detection logic and MITRE ATT&CK coverage.

Idan Cohen

EKS Role Unchaining: Tracing AWS Events Back to Pods for Enhanced Security

Learn two approaches for EKS unchaining that allow teams to associate AWS events with the pods that triggered them.

Stav Ochakovski

How Missing Logs Impact Cloud Security

Microsoft experienced an issue with internal monitoring agents, resulting in incomplete logs for some services. Get more details and recommended next steps.

Or Aspir

Automating AWS Infrastructure Creation with Crossplane and GitOps

A while back, I started migrating my CD to a full GitOps process.

Tactical Guide to Threat Hunting in Snowflake Environments

It was brought to our attention that a threat actor has been observed using stolen customer credentials to target organizations utilizing Snowflake databases.