Emulating and Detecting Scattered Spider-like Attacks

This report demonstrates an AWS-focused adversary-emulation of Scattered Spider–like attacks using Mitigant and Sekoia to map attacker TTPs across the MITRE ATT&CK framework, showcase detectable events (e.g., EnableSerialConsoleAccess, CreateUser, PutBucketReplication), provide detection rules and IOCs, and illustrate how Threat-Informed Defense (CTI + SOC + emulation) improves cloud detection and response.