Techniques for incident response and static analysis representation in computing environments

A non-transitory computer-readable medium storing a set of instructions for detecting an attack path in a computing environment, the set of instructions comprising:

• one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:
• detect a forensic artifact in a computing environment, the forensic artifact including an identifier of a resource deployed in the computing environment;
• generate an inspectable disk based on the resource;
• inspect the inspectable disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity issue;
• generate in a security database a representation of:
• the detected forensic artifact, the resource, and the cybersecurity object, wherein the security database further includes a representation of the computing environment;
• determine a number of hops between the resource and another resource;
• generate a potential lateral movement path between the resource and the another resource, the potential lateral movement path including at least another entity deployed in the computing environment between the resource and the another resource;
• and
• initiate a remediation action based on the cybersecurity issue.

A system for detecting an attack path in a computing environment comprising:

• a processing circuitry;
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• detect a forensic artifact in a computing environment, the forensic artifact including an identifier of a resource deployed in the computing environment;
• generate an inspectable disk based on the resource;
• inspect the inspectable disk for a cybersecurity object, the cybersecurity object indicating a cybersecurity issue;
• generate in a security database a representation of:
• the detected forensic artifact, the resource, and the cybersecurity object, wherein the security database further includes a representation of the computing environment;
• determine a number of hops between the resource and another resource;
• generate a potential lateral movement path between the resource and the another resource, the potential lateral movement path including at least another entity deployed in the computing environment between the resource and the another resource;
• and
• initiate a remediation action based on the cybersecurity issue.