从 SIEM 到 SOC：使用 AWS 在云端构建 AI 原生安全（由 CrowdStrike 赞助）.pdf

1、 2025,Amazon Web Services,Inc.or its affiliates.All rights reserved.2025,Amazon Web Services,Inc.or its affiliates.All rights reserved.AIM289-SFrom SIEM to SOC:Building AI-Native Security in the Cloud with AWSJenn Reed(she/her)WW Principal Security PSAAWSManoj Mohanan(He/him)Sr Manager for Product M

2、anagementCrowdStrikeRob Solomon(he/him)Staff Solutions Architect AWS AllianceCrowdStrike 2025,Amazon Web Services,Inc.or its affiliates.All rights reserved.AgendaCrowdStrike Falcon Next-Gen SIEMFalcon Next-Gen SIEM for AWSMarketplace Pay as you go 2025,Amazon Web Services,Inc.or its affiliates.All r

3、ights reserved.2025 GLOBAL THREAT REPORT2025 THREAT HUNTING REPORTAdversaries armed with AI are faster,stealthier,and more sophisticated.320+Organizations infiltrated byAI-enabled FAMOUS CHOLLIMA1SOPHISTICATION2xVishing is on track to double 2024 volume by the end of 2025136%Surge in cloud intrusion

4、s in H1 2025 vs.all of 2024SPEED48 minsAverage breakout time,Fastest breakout time observed at 51sSTEALTH81%Of hands-on-keyboard intrusions1were malware-free CROWDSTRIKE,INC.ALL RIGHTS RESERVED.|CROWDSTRIKE CONFIDENTIAL/PROPRIETARY INFORMATION1 From July 2024 to June 2025 2025,Amazon Web Services,In

5、c.or its affiliates.All rights reserved.SCATTERED SPIDERCompletes ransomware attacks in 24 hoursINITIAL ACCESSPhone/EmailObtained valid credentials via vishing or help desk social engineering targeting IT staffLATERAL MOVEMENTIdentityAbused valid credentialsto authenticate to a cloud application EXE

6、CUTIONCloudEstablished a foothold by logging in to AWS admin panel and running commands on the cloud VM through the management agentPERSISTENCEEndpointGained persistence by creating a new user and downloading FleetDeckSource:CrowdStrike 2025 Global Threat ReportRansomware Drop 2025,Amazon Web Servic