Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
Unit 42 demonstrates a behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles, enabling lightweight SQL-based anomaly detection. Over 40,000 identities across 125 AWS environments were clustered using unsupervised ML (UMAP + HDBSCAN) into functional roles like administrators, DevOps, and security tools. A logistic regression classifier with L1 regularization distills cluster logic into a few dozen weighted operations implementable in standard SQL, enabling scalable role inference and deviation detection without continuous ML pipelines.
Detection / Hunteropenrouter
Immediate Actions
- Enable AWS CloudTrail logging across all regions if not already active
- Review identities with AdministratorAccess for necessity and reduce to least privilege
Key Takeaways
- 40,000+ identities from 125 cloud environments analyzed over two months
- AWS exposes 15,000+ possible operations across 240 services for identity behavior analysis
- 94% of admin-cluster identities invoked ConsoleLogin; fewer than 1% in other clusters did
- L1 regularization compresses the classifier to a few dozen defining operations with coefficients
- Methodology extends to other cloud providers, Kubernetes, and SaaS audit logs
Attack Chain
- Data Collection: AWS CloudTrail audit logs ingested and vectorized into boolean identity-operation vectors
- Dimensionality Reduction: UMAP reduces 15,000+ dimension sparse vectors to 32-value dense embeddings
- Clustering: HDBSCAN groups identities into behavioral clusters representing functional roles
- Classification: Logistic regression with L1 regularization distills cluster logic into weighted operation sets
- Detection: SQL queries classify new identities and flag behavioral deviations from established roles
- Alerting: Cortex XDR/XSIAM CDR module alerts on role-deviant activity mapped to MITRE ATT&CK techniques
Affected Systems
- AWS CloudTrail logging environments
- AWS IAM identities (human and machine)
- AWS Management Console users
- Multi-cloud and SaaS audit log sources
- Kubernetes environments
- CI/CD pipeline identities
Detection Availability
- Published: Other detection logic
- Platforms: Cortex XDR Analytics BIOC, Cloud Detection & Response Module (CDR), Standard SQL
Describes SQL-implementable detection logic and lists Cortex XDR/XSIAM CDR alert names mapped to MITRE ATT&CK. No rule bodies published.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | CDR module alerts exist for cloud identity anomalies but require CloudTrail log ingestion and Cortex XDR/XSIAM deployment. |
| Network Visibility | Low | Article focuses on API audit log analysis, not network traffic patterns or flow data. |
| Detection Difficulty | Moderate | Lightweight SQL logic is straightforward once behavioral baselines are established, but initial clustering pipeline requires ML expertise. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| An identity previously classified as a backup service suddenly invokes administrative operations like ConsoleLogin or IAM role modifications (T1098.003) | AWS CloudTrail API call logs | Defense Evasion | Medium — role changes or new admin tasks can trigger |
| An identity invokes operations in a previously dormant cloud region, indicating potential attacker activity (T1535) | CloudTrail logs with region metadata | Discovery | Low — dormant region usage is rare legitimately |
| An identity modifies web ACLs or deletes backup vaults, deviating from its established behavioral cluster baseline (T1562, T1490) | CloudTrail logs for WAF and backup API calls | Impact | Low — destructive operations are rare in normal workflows |
Required Log Sources
- AWS CloudTrail logs
- Cloud audit logs (multi-cloud)
- Cortex XDR/XSIAM CDR alerts
- IAM identity access logs
Key Behavioral Indicators
- Backup service identity invoking ConsoleLogin or admin APIs
- Identity operating in previously dormant cloud regions
- Web ACL deletion by non-administrative identity
- IAM trust policy modification enabling cross-account access
- S3 bucket exposure via ACL or policy modification by unexpected identity
- Lambda cross-account sensitive permissions configured by non-DevOps identity
Control Gaps
- Static IAM permission analysis cannot detect behavioral deviations
- CSPM tools miss active behavior vs. assigned capabilities
- Over-privileged identities in production for years without detection
- Masquerading via benign labels and pre-existing permission profiles
False Positive Assessment
Medium — Legitimate role changes, new project launches, or administrative task reassignment can cause identities to temporarily deviate from established behavioral clusters.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement behavioral baseline monitoring for all cloud identities using audit logs
- Enforce zero standing privileges and just-in-time access for administrative roles
- Deploy cloud detection and response tooling that correlates identity behavior with assigned roles
- Monitor for cross-account IAM trust policy modifications and web ACL changes
User Protection
- Audit AWS IAM Identity Center AdministratorAccess assignments for legitimacy
- Review service identities performing operations outside their expected functional scope
Security Awareness
- Train cloud teams on the distinction between assigned permissions and observed behavior
- Establish naming conventions for cloud identities to aid behavioral classification
MITRE ATT&CK Mapping
Execution
Persistence
Defense Impairment
Discovery
Impact
Plain-Language Summary
Researchers built a machine learning model that groups cloud identities by their actual behavior rather than their assigned permissions. They analyzed over 40,000 identities across 125 AWS environments and found that identities naturally cluster into roles like administrators, backup services, and security tools. By converting this model into lightweight logic that runs in standard database queries, organizations can continuously classify identities and flag when one suddenly behaves outside its normal role. This helps detect attackers who hide behind over-privileged or benign-looking accounts.
