Unit 42 Maps Cloud Identities by Behaviour to Expose Anomalies

Palo Alto Networks’ Unit 42 has described a behavioural clustering model for mapping cloud identities to their functional roles, based on activity recorded in audit logs. The researchers analysed more than 40,000 identities across 125 cloud environments over two months, using AWS CloudTrail data.

They applied Uniform Manifold Approximation and Projection (UMAP) and Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN) to group identities according to the AWS operations they actually performed, rather than relying solely on names or assigned IAM permissions.

The resulting clusters corresponded to roles including administrators, DevOps users, infrastructure-as-code runners, CI/CD systems, security tools, backup agents, networking components and FinOps platforms. In the largest example, around 5,000 identities across more than 100 cloud projects were identified as administrative users operating primarily through the AWS Management Console.

Roughly 94% invoked `ConsoleLogin`, compared with fewer than 1% of identities in other clusters, while about 60% performed additional operations associated with normal console use. Naming patterns such as `AWSReservedSSO_AdministratorAccess_` provided supporting evidence, but the researchers stressed that behaviour offers stronger context than labels or permissions alone.

Unit 42 also showed how cluster findings can be distilled into interpretable logistic-regression classifiers. Using L1 regularisation, the models reduce the decision logic to a relatively small set of weighted operations, allowing organisations to classify identities through standard SQL without repeatedly running the full machine-learning pipeline. The approach is presented as a way to establish behavioural baselines and identify anomalies, such as a backup service suddenly performing administrative actions. The researchers said the methodology could be extended beyond AWS to other cloud providers, SaaS and Kubernetes audit data.