UNMASKING CLOUD IDENTITIES: FROM BEHAVIORAL CLUSTERING TO AUTOMATED DETECTION

Summary from the TLDR InfoSec newsletter

Unit 42 clustered the CloudTrail activity of over 40,000 identities across 125 AWS environments and found they fall into consistent functional roles like console admins, CI/CD runners, backup agents, and security tools, regardless of naming or assigned IAM policies. That behavioral baseline matters because attackers masquerade behind benign labels and existing permission profiles, so a backup service suddenly running admin actions stands out even when its permissions allow it. The approach distills into a lightweight classifier that runs as standard SQL, letting teams tag identity roles at scale without a full ML pipeline.