Security teams should combine high-fidelity detections with threat hunting focused on known tactics, techniques, and procedures used in cloud intrusions. The practical goal is to narrow the search to suspicious identity and access activity across AWS and Azure, then review the surrounding log context quickly. Point detections at the behaviours most associated with active threat actors, not broad noise.
Focus on the behaviours that give threat hunters the earliest signal
Cloud intrusions usually become visible through a short list of behaviours: unusual authentication patterns, token or key abuse, privilege escalation, lateral movement between cloud services, and access from unfamiliar infrastructure. The strongest detections are specific enough to flag those behaviours quickly, but narrow enough to avoid drowning analysts in routine administrative noise.
That is why cloud hunting works best when it is built around known attacker tradecraft rather than generic “suspicious activity” rules. ATT&CK-style technique mapping helps teams ask better questions about what the actor is trying to do, especially when the activity is still low-volume and looks technically valid at the API layer.
For cloud environments, the most useful telemetry often sits where identity, control plane, and workload activity intersect. If the alert cannot answer who acted, from where, with what authority, and what changed next, it is usually too weak to stop a broader incident early. MITRE ATT&CK Enterprise Matrix remains one of the clearest ways to structure those hunts around credential access, privilege escalation, and lateral movement.
Build detections around identity context, not just cloud events
In AWS and Azure, the highest-value hunting patterns tend to revolve around identity and access behaviour: unexpected role assumptions, new API clients, access outside the usual geography or service boundary, suspicious consent grants, and privilege changes that do not fit normal administration. Those patterns matter because cloud attackers often try to blend into legitimate control-plane activity instead of triggering endpoint-style alarms.
High-fidelity detections should therefore be anchored to the surrounding identity context. A single event may not be decisive, but a sequence of events such as a new token use, followed by enumeration, followed by creation of a persistence mechanism is much more actionable. The practical question is not whether the event is technically allowed, but whether it makes sense for that identity, workload, or administrative path.
For teams dealing with repeated cloud abuse, the key operational mistake is treating every permissioned action as equally benign. Cloud logging is rich, but it only becomes useful when detections are tuned to likely intrusion paths and backed by enough context to separate normal automation from early-stage compromise. NHIMG’s Ultimate Guide to NHIs, Key Challenges and Risks is a useful reference for the visibility and over-privilege problems that make this kind of detection harder than it should be.
Risk and Threat Considerations
Cloud threat actor activity is often hard to spot early because the attacker is operating through valid credentials, approved APIs, and normal-looking administrative paths. That means the main risk is not only compromise, but also delayed recognition, which gives the actor more time to expand access, establish persistence, and reach sensitive services before the signal becomes obvious.
Failure mechanism: Detections that are too broad generate noise, while detections that are too generic miss the small identity and access changes that usually precede a larger cloud incident. Attackers exploit that gap by staying inside expected control-plane behaviour until they can escalate privilege or pivot to a new service boundary.
Impact: The result can be a much larger blast radius than the initial event suggests, including unauthorized data access, token reuse, persistence in cloud services, and faster lateral movement across tenants, subscriptions, or accounts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Cloud threat actors often use valid identities and tokens to blend into normal access patterns. |
| T1136 — Create Account | Account or role creation is a common persistence step after initial cloud access. | |
| T1484 — Domain Policy Modification | Privilege and access policy changes can enable escalation and broader cloud compromise. | |
| Recommendation — Map suspicious cloud logins to T1078 and hunt for valid-account abuse across control-plane activity. Monitor for unexpected identity creation and investigate it as a persistence indicator. Alert on policy modifications that expand access or weaken cloud authorization boundaries. | ||
| NIST CSF 2.0 | DE.CM — Continuous Monitoring | The question is about detecting threat activity early through ongoing monitoring and context. |
| Recommendation — Build continuous monitoring for identity, API, and control-plane activity that indicates intrusion. | ||
| CIS Controls v8 | 8 — Audit Log Management | High-fidelity cloud detection depends on collecting and reviewing identity and access logs. |
| 6 — Access Control Management | Suspicious cloud activity is often visible as abnormal privilege use or access changes. | |
| Recommendation — Centralize and retain cloud audit logs so hunters can reconstruct suspicious identity activity. Review and tighten cloud access paths to reduce the attacker behaviors your detections must cover. | ||
| CSA MAESTRO | M1 — Identity and Access Management for AI Systems | Cloud intrusion detection depends on controlling and observing identity-driven access paths. |
| Recommendation — Apply identity-centric monitoring to preserve attribution and limit unauthorized cloud actions. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Exposure | Cloud threat actors commonly begin with stolen keys, tokens, or other identity material. |
| NHI-04 — Excessive Permissions | Excess privilege makes cloud actor activity more damaging and easier to pivot with. | |
| Recommendation — Detect exposed or reused cloud credentials and treat them as priority intrusion signals. Reduce over-privilege so suspicious cloud activity is easier to contain and attribute. | ||
Practitioner Guidance
What to prioritise: Tune hunting and alerting to the identity events most likely to precede cloud compromise, especially unusual role changes, new token use, and cross-boundary access. If a detection cannot tie the activity to a plausible actor path, it is probably too weak to support fast triage.
What to verify: For every candidate alert, verify the actor, the originating context, the privilege used, and the immediate follow-on actions. The fastest way to reduce false positives is to confirm whether the sequence matches a known administrative or automation pattern before escalating.
Practitioner takeaway: Early cloud compromise is usually caught by behavioural context, not by a single loud event, so the goal is to detect the sequence that shows intent before the attacker’s access turns into persistence or privilege expansion.
Related resources from NHI Mgmt Group
- How should security teams detect automated bot activity before it turns into account takeover or scraping at scale?
- How should security teams detect credential compromise before it turns into account takeover?
- How should security teams detect cloud activity that is trying to hide in normal volume?
- How should security teams detect fast flux activity in DNS traffic before it supports a broader intrusion?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
