Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries.
We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. As cloud environments expand to include human, machine and autonomous agent identities, mapping the functional roles of these identities has become a significant security challenge. To address this challenge, we designed a behavioral clustering model that extracts activity patterns from cloud audit logs. By adopting a clustering-based approach to identity mapping, organizations can gain greater visibility into cloud activity and integrate these behavioral patterns into automated threat detection mechanisms.
Using a Generalized Suffix Tree , we algorithmically discovered the cluster's most frequent substrings rather than searching for specific arbitrary keywords like “admin.” Among the top results was AWSReservedSSO_AdministratorAccess_ – the default prefix generated when assigning AdministratorAccess via AWS IAM Identity Center. This means that we can determine how each cloud operation increases or decreases the likelihood that an identity belongs to a target cluster, and which operations are most important for prediction.
Additionally, we demonstrate how lightweight heuristic logic can be extracted directly from the clustering map, which can be implemented in standard SQL. The APIs with the highest op_score serve as behavioral markers, occurring frequently within the selected cluster while remaining relatively rare across the rest of the global dataset.
We also show how an identity’s behavioral patterns provide richer context for cloud threat detection. The methodology applied in our behavioral clustering model uses unsupervised machine learning algorithms, specifically Uniform Manifold Approximation and Projection ( UMAP ) and Hierarchical Density-Based Spatial Clustering of Applications with Noise ( HDBSCAN ), to construct a reliable behavioral map. This approach automatically categorizes a vast collection of cloud identities into distinct, clustered groups. While our research specifically focuses on AWS CloudTrail data, the methodology can be easily extended to audit logs from other cloud providers, software as a service (SaaS), Kubernetes and other environments.
What changed
This reality forces us to draw a distinction between capabilities and active behavior: Given that thousands of identities are operating across complex cloud environments, we are left with the following questions: Analyzing the specific cloud operations an identity invokes, as captured in AWS CloudTrail , provides a clear picture of its day-to-day behavior and role.
After discovering the behavioral groups using the above pipeline, we can scale this detection capability to ingest new identities and automatically determine whether they belong to a known cluster.
Who is affected
Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: Unit 42 Cloud Security Assessment is an evaluation service that reviews cloud infrastructure to identify misconfigurations and security gaps.
When observing a large enough collection of identities across multiple organizations, a macro-level picture begins to emerge.
The visual datapoint clustering, along with additional quantitative metrics, indicate that cloud identities have a strong tendency to share similar behavioral traits, often mapping to the same functional roles across different organizations.
Consisting of roughly 5,000 identities spanning over 100 cloud projects, it represents one of the largest, most dense clusters in our dataset: administrative user identities.
To further validate the hypothesis that this is a cluster of administrative user identities, we also examined textual metadata.
Combining these quantitative methods with visual mapping allows us to confidently conclude that this cluster indeed represents administrative users operating primarily through the AWS Management Console.
Why this matters
Using a Generalized Suffix Tree , we algorithmically discovered the cluster's most frequent substrings rather than searching for specific arbitrary keywords like “admin.” Among the top results was AWSReservedSSO_AdministratorAccess_ – the default prefix generated when assigning AdministratorAccess via AWS IAM Identity Center.
This means that we can determine how each cloud operation increases or decreases the likelihood that an identity belongs to a target cluster, and which operations are most important for prediction.
The technical picture
Additionally, we demonstrate how lightweight heuristic logic can be extracted directly from the clustering map, which can be implemented in standard SQL.
The APIs with the highest op_score serve as behavioral markers, occurring frequently within the selected cluster while remaining relatively rare across the rest of the global dataset.
How organizations are responding
We also show how an identity’s behavioral patterns provide richer context for cloud threat detection.
The methodology applied in our behavioral clustering model uses unsupervised machine learning algorithms, specifically Uniform Manifold Approximation and Projection ( UMAP ) and Hierarchical Density-Based Spatial Clustering of Applications with Noise ( HDBSCAN ), to construct a reliable behavioral map.
This approach automatically categorizes a vast collection of cloud identities into distinct, clustered groups.
While our research specifically focuses on AWS CloudTrail data, the methodology can be easily extended to audit logs from other cloud providers, software as a service (SaaS), Kubernetes and other environments.
When it comes to accurately detecting malicious activity within cloud environments, context is key.
Consider a scenario where a cloud identity enumerates all resources within your environment.
What to watch next
Watch for additional exploitation reporting, newly published indicators, and changes to vendor guidance.
What remains unknown
The available reporting does not establish whether the issue is being actively exploited in the wild.