Ariel Szarf, Ariel Szarf is a Senior Security Researcher at Mitiga, specializing in threat hunting and incident response across cloud and SaaS platforms. Ariel focuses on uncovering novel attack techniques and enhancing forensic visibility in complex cloud and SaaS environments.

Ariel Szarf is a Senior Security Researcher at Mitiga, specializing in threat hunting and incident response across cloud and SaaS environments. His work focuses on identifying emerging attack techniques and improving forensic visibility at scale. Ariel thrives on solving puzzles in complex systems — though sadly, his skills have yet to help him find his missing socks.

No One Mourns the Wicked: Your Guide to a Successful Salesforce Threat Hunt

Salesforce is a cloud-based platform widely used by organizations to manage customer relationships, sales pipelines, and core business processes.

Mitiga Security Advisory: Abusing the SSM Agent as a Remote Access Trojan

Mitiga's research discovered a significant new post-exploitation security concept: involving the use of Systems Manager (SSM) agent as a Remote Access Trojan (RAT) on Linux and Windows machines, controlling them using another AWS account. We shared our research with the AWS security team and included some of their feedback to this advisory.

More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan

Imagine that you’re a SOC (Security Operations Center) analyst receiving an alert about suspicious behavior from a binary on an EC2 instance. After checking the binary on VirusTotal, you find it was an AWS-developed software signed by Amazon. Further investigation reveals that it communicated only with Amazon-owned IP addresses.

Ariel Szarf

Ariel Szarf is a Senior Security Researcher at Mitiga, specializing in threat hunting and incident response across cloud and SaaS platforms. Ariel focuses on uncovering novel attack techniques and enhancing forensic visibility in complex cloud and SaaS environments.

No One Mourns the Wicked: Your Guide to a Successful Salesforce Threat Hunt

Mitiga Security Advisory: Abusing the SSM Agent as a Remote Access Trojan

More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan

Mitiga Security Advisory: Lack of Forensic Visibility with the Basic License in Google Drive

Guide: CircleCI Breach Cybersecurity Incident Hunting Guide

Oops, I Leaked It Again — How Mitiga Found PII in Exposed Amazon RDS Snapshots

Get a Demo