/
← Voltar ao feed
low

Unit 42 details behavioral clustering of AWS CloudTrail logs to map cloud identity roles and detect masquerading

1 fonte(s) · 1 atualização(ões) · publicado 14/09/2026 07:00 · coletado há 1 dia

Unit 42 (Palo Alto Networks) published research on a behavioral clustering model that maps cloud identities to functional roles from audit log activity. The model covered more than 40,000 identities across 125 cloud environments over two months. It groups identities such as administrators, backup services, security tooling and DevOps by the API operations they invoke, rather than by naming conventions or assigned IAM permissions. The goal is better context for cloud threat detection, since attackers use over-privileged identities and benign labels to masquerade. This is defensive methodology research, not a report of an incident or vulnerability.

Technical Details

  • The research uses AWS CloudTrail data. Each identity is vectorized as a sparse boolean vector over more than 15,000 possible operations.
  • UMAP (cosine distance) reduces the vectors to 32-dimensional dense embeddings for clustering and to 2D for visualization. HDBSCAN then clusters the embeddings and flags outliers.
  • Clusters were interpreted using operation frequency, c-TF-IDF scoring, attribute-based map highlighting and identity-name substring mining (Generalized Suffix Tree).
  • The largest cluster, about 5,000 administrator console users across more than 100 cloud projects, was defined by ConsoleLogin (about 94% of its identities, versus under 1% in other clusters). About 60% also invoked GetCostAndUsage and GetCostForecast. Names often contained the AWSReservedSSO_AdministratorAccess_ prefix.
  • Other clusters include IaC runners and CI/CD systems.
  • For automated detection, an L1-regularized (Lasso) logistic regression on the sparse vectors distills each cluster into a few dozen weighted operations. This can be implemented in standard SQL, so the full ML pipeline need not run continuously.
  • The authors say the approach extends to other cloud providers, SaaS and Kubernetes audit logs. An example high-risk anomaly is a compromised backup service suddenly executing administrative actions.

Remediation

  • Combine posture management (what an identity is permitted to do) with behavioral baselines (what it actually does) to spot deviations and defense evasion.
  • Enforce least privilege and review over-privileged identities.
  • The vendor points to Cortex Cloud, Cortex XDR/XSIAM, Idira PAM and Idira IGA as relevant products.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 14/09/2026 07:00 · coletado 19/10 17:56 primeiro registro

    Unit 42 details behavioral clustering of AWS CloudTrail logs to map cloud identity roles and detect masquerading

    ler a análise desta fonte

    Unit 42 (Palo Alto Networks) published research on a behavioral clustering model that maps cloud identities to functional roles from audit log activity. The model covered more than 40,000 identities across 125 cloud environments over two months. It groups identities such as administrators, backup services, security tooling and DevOps by the API operations they invoke, rather than by naming conventions or assigned IAM permissions. The goal is better context for cloud threat detection, since attackers use over-privileged identities and benign labels to masquerade. This is defensive methodology research, not a report of an incident or vulnerability.

    Technical Details

    • The research uses AWS CloudTrail data. Each identity is vectorized as a sparse boolean vector over more than 15,000 possible operations.
    • UMAP (cosine distance) reduces the vectors to 32-dimensional dense embeddings for clustering and to 2D for visualization. HDBSCAN then clusters the embeddings and flags outliers.
    • Clusters were interpreted using operation frequency, c-TF-IDF scoring, attribute-based map highlighting and identity-name substring mining (Generalized Suffix Tree).
    • The largest cluster, about 5,000 administrator console users across more than 100 cloud projects, was defined by ConsoleLogin (about 94% of its identities, versus under 1% in other clusters). About 60% also invoked GetCostAndUsage and GetCostForecast. Names often contained the AWSReservedSSO_AdministratorAccess_ prefix.
    • Other clusters include IaC runners and CI/CD systems.
    • For automated detection, an L1-regularized (Lasso) logistic regression on the sparse vectors distills each cluster into a few dozen weighted operations. This can be implemented in standard SQL, so the full ML pipeline need not run continuously.
    • The authors say the approach extends to other cloud providers, SaaS and Kubernetes audit logs. An example high-risk anomaly is a compromised backup service suddenly executing administrative actions.

    Remediation

    • Combine posture management (what an identity is permitted to do) with behavioral baselines (what it actually does) to spot deviations and defense evasion.
    • Enforce least privilege and review over-privileged identities.
    • The vendor points to Cortex Cloud, Cortex XDR/XSIAM, Idira PAM and Idira IGA as relevant products.