Researchers Map AWS Identity Behavior to Improve Cloud Threat Detection
Summary
Researchers analyzed AWS CloudTrail activity from more than 40,000 identities across 125 cloud environments, using behavioral clustering to identify functional roles and lightweight classifiers to support scalable identity detection.
Key points
- The study analyzed two months of activity from more than 40,000 identities across 125 cloud environments.
- Researchers used UMAP and HDBSCAN to cluster identities based on AWS CloudTrail operations, identifying roles such as administrators, DevOps systems, security tools and backup agents.
- An analysis of one large cluster found that about 94% of its identities used the AWS Console login operation, supporting its identification as administrative users.
- The researchers trained interpretable logistic regression classifiers on sparse operation vectors, using L1 regularization to focus on a smaller set of defining operations.
- The resulting role-classification logic can be implemented in standard SQL, avoiding the need to continuously run the more resource-intensive clustering pipeline.
- Behavioral role context may help identify deviations missed by static permission analysis, such as a backup service suddenly performing administrative actions.
Article Details
- Attack Vectors
- Attackers may exploit over-privileged cloud identities to perform operations that tighter access controls would block.
- Attackers may masquerade by using pre-existing permission profiles and benign labels, making malicious cloud activity harder to detect.
- A compromised backup service may deviate from its normal behavior by executing administrative actions.
- The article’s alert examples cover cloud administration commands, password-policy and account discovery, web ACL deletion, activity in dormant cloud regions, backup-vault deletion, cloud-instance creation, cross-account role changes, and S3 bucket exposure through ACL or policy modification.
- Defensive Notes
- Use cloud audit-log behavior to establish functional identity baselines and detect deviations that static permission analysis may miss.
- Apply behavioral clustering to identify roles such as administrators, DevOps identities, security tools, and backup services; the article describes UMAP and HDBSCAN for clustering.
- Train interpretable classifiers on identity behavior and distill relevant operations into lightweight SQL logic for scalable role inference.
- Enforce least privilege and use behavioral context to identify anomalous or potentially compromised identities.
MITRE ATT&CK
T1087.004 · Cloud AccountThe appendix maps the “AWS resource discovery” alert to cloud account discovery.T1098.003 · Additional Cloud RolesThe appendix maps cross-account Lambda permissions, IAM role trusted-policy changes, cross-account IAM role creation, and S3 bucket exposure via ACL or policy modification to this technique.T1201 · Password Policy DiscoveryThe appendix maps the “AWS Password Policy Discovery” alert to this technique.T1490 · Inhibit System RecoveryThe appendix maps deletion of an AWS Backup vault to this technique.T1535 · Unused/Unsupported Cloud RegionsThe appendix maps compute activity in a dormant cloud region to this technique.T1562 · Impair DefensesThe appendix maps the “AWS web ACL deletion” alert to this technique.T1578.002 · Create Cloud InstanceThe appendix maps a cloud instance creation attempt to this technique.T1651 · Cloud Administration CommandThe appendix maps the “AWS SSM send command attempt” alert to this technique.
Vendors
Products
AWSTo illustrate the practical application of our model, we provide an in-depth analysis of the dataset's largest cluster: administrator console users in Amazon Web Services (AWS).AWS CloudTrailWhile our research specifically focuses on AWS CloudTrail data, the methodology can be easily extended to audit logs from other cloud providers, software as a service (SaaS), Kubernetes and other environments.AWS IAM Identity Center– the default prefix generated when assigning AdministratorAccess via AWS IAM Identity Center.AWS Management ConsoleHowever, for the purposes of this research, we analyze the cluster at a macro level, focusing on identities operating through the AWS Management Console.Cortex CloudCortex CloudCortex XDRCortex XDR and XSIAMIdira Identity Governance and Administration (IGA)Idira Identity Governance and Administration (IGA)Idira Privileged Access Management (PAM)Idira Privileged Access Management (PAM)XSIAMCortex XDR and XSIAM
Tools
HDBSCANand Projection (UMAP) and Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN), to construct a reliable behavioral map.UMAPuses unsupervised machine learning algorithms, specifically Uniform Manifold Approximation and Projection (UMAP) and Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN), to construct a