HACKING PROJECT · cloud · Advanced
Multi-Cloud Threat Detection System
Provide single-pane detection of adversary behavior across AWS, Azure, and GCP by normalizing telemetry and correlating cross-cloud attack sequences.
Enterprises now run workloads across AWS, Azure, and GCP simultaneously, but each provider emits telemetry in different schemas with different identity models, leaving detection teams blind to attacks that pivot across clouds. Native tooling (GuardDuty, Defender, SCC) is siloed and does not correlate a single adversary campaign spanning multiple providers. This fragmentation delays detection of credential abuse, data exfiltration, and lateral movement across cloud boundaries.
**What you'll build**
Build a unified multi-cloud detection pipeline that ingests CloudTrail, Azure Activity/Entra logs, and GCP Audit Logs into a common schema (OCSF), normalizes identity and resource entities, and runs correlation/detection-as-code rules (Sigma) plus behavioral analytics to surface cross-cloud attack chains. Detections map to MITRE ATT&CK Cloud techniques and feed a unified alerting and case-management layer.
**Objective** — Provide single-pane detection of adversary behavior across AWS, Azure, and GCP by normalizing telemetry and correlating cross-cloud attack sequences.
**Expected outcome** — A working detection stack that ingests logs from at least two cloud providers, normalizes them to OCSF, and fires ATT&CK-mapped Sigma detections on simulated cross-cloud attacks with a demonstrable correlated alert.
**Difficulty** — Advanced — demands multi-provider log expertise, schema normalization, and detection engineering across heterogeneous identity models.
**Primary category** — Cloud Security / Detection Engineering; Secondary = SOC, Threat Hunting, SIEM
**Security domains** — Primary = Cloud Security; Secondary = Blue Team, Threat Detection, SOC, Threat Intelligence, Incident Response
**Technical focus** — Cloud telemetry ingestion, log normalization (OCSF/ECS), detection-as-code (Sigma), SIEM/data-lake analytics, UEBA/behavioral analytics, cross-cloud correlation, alert triage, identity threat detection, CSPM signal fusion
**Core technologies** — Languages: Python, SQL, KQL, YAML; Frameworks/Libraries: Sigma, OCSF, ELK/OpenSearch, Pandas; Security Tools: AWS GuardDuty/CloudTrail, Azure Defender/Sentinel, GCP SCC/Chronicle, Wazuh, Falco, Sigma converters; Cloud/Infra: AWS, Azure, GCP, Kafka/streaming, Terraform; AI/Data: anomaly detection (Isolation Forest, clustering), UEBA models; Databases: OpenSearch/Elasticsearch, ClickHouse, BigQuery
**Where it's valued** — Large enterprises, MSSPs/MDR providers, fintech, SaaS, cloud-native companies, regulated sectors with multi-cloud mandates
**Careers it builds toward** — Cloud Security Engineer, Detection Engineer, SOC Analyst (Tier 2/3), Threat Hunter, Security Data Engineer, Cloud SecOps Lead
**Framework alignment**
• MITRE ATT&CK: Valid Accounts: Cloud Accounts T1078.004, Cloud Service Discovery T1526, Cloud Infrastructure Discovery T1580, Data from Cloud Storage T1530, Transfer Data to Cloud Account T1537, Exfiltration to Cloud Storage T1567.002, Account Manipulation T1098 (incl. T1098.001/.003), Cloud Administration Command T1651
• NIST CSF 2.0: Detect (primary), Identify, Respond
• OWASP: N/A (infrastructure detection); tangential to OWASP API Top 10 for cloud API abuse
• CIS Controls v8: 8 Audit Log Management, 13 Network Monitoring & Defense, 6 Access Control Management, 17 Incident Response Management
**Innovation** — Improved Existing Solution — cross-cloud correlation with OCSF normalization and ATT&CK-mapped detections is ahead of most in-house SOCs and has real MDR product relevance. Scores: Innovation 7/10, Startup 7/10, Enterprise-Readiness 8/10, Patent = Possible.