BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.hackfest.ca//hf2023//speaker//CKSUDS
BEGIN:VTIMEZONE
TZID:EST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T070000Z
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T080000Z
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-hf2023-XRQDEH@cfp.hackfest.ca
DTSTART;TZID=EST:20231014T100000
DTEND;TZID=EST:20231014T105000
DESCRIPTION:Security monitoring in any environment is made or broken by the
  signal quality in the event logs. With mass migration to the cloud\, defe
 nders are putting all of their logging capability "eggs" in one provider's
  "basket". This works when the logging facilities are well designed and wo
 rk robustly\, but what do you do when issues arise?\n\nIn this talk\, we w
 ill examine logging facilities in Azure (concentrating on events generated
  by Azure AD and Microsoft 365) and discuss multiple problems that we have
  observed in monitoring them. \n \nThese include:  \n- Blind spots hiding 
 critical security events\n- Poorly documented events\, attributes and magi
 c values \n- Missing important information about user actions\n- Bugs in l
 og records \n- Unannounced changes that break detection queries\n- Log pol
 lution opportunities\, potentially leading to RCE \n- and more \n\nWe will
  examine impact of these issues on defense and monitoring\, opportunities 
 for red-teamers\, and the ways the cloud provider can address the problems
  going forward.
DTSTAMP:20260711T173632Z
LOCATION:Track #2
SUMMARY:Between a Log and a Hard Place: (mis)Adventures in Azure Logs - Dmi
 triy Beryoza
URL:https://cfp.hackfest.ca/hf2023/talk/XRQDEH/
END:VEVENT
END:VCALENDAR