{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/behavior-analysis/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS Identity and Access Management","AWS CloudTrail"],"_cs_severities":["medium"],"_cs_tags":["cloud-security","identity-access-management","behavior-analysis","detection-engineering"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eResearchers at Unit 42 have identified that attackers frequently bypass traditional identity and access management (IAM) controls by using masquerading techniques. By leveraging pre-existing permission profiles, benign labels, and legitimate service accounts, adversaries obscure their actions within cloud environments. The research analyzed behavior from over 40,000 identities across 125 cloud environments, establishing that cloud identities naturally aggregate into distinct functional clusters based on their API invocation patterns.\u003c/p\u003e\n\u003cp\u003eDefenders can move beyond static policy reviews, which often fail to account for over-privileged identities, by implementing behavioral clustering using algorithms like UMAP and HDBSCAN. By mapping observed activity against these clusters, organizations can identify anomalies where an identity deviates from its typical functional role (e.g., an administrator account performing discovery activity inconsistent with console user patterns). This approach provides context for cloud detection and response (CDR) efforts, allowing for the classification of identities at scale using lightweight SQL heuristics derived from these clusters.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe use of masquerading techniques allows attackers to conduct reconnaissance, account manipulation, and data exfiltration while blending into standard administrative or service-level traffic. If undetected, this leads to unauthorized resource discovery, permission modifications, and the compromise of cloud-native infrastructure, with the potential for widespread data loss or persistent unauthorized access across multiple cloud projects.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement behavioral profiling to categorize service accounts and human identities based on observed API activity rather than solely relying on assigned IAM policies.\u003c/li\u003e\n\u003cli\u003eIntegrate cloud detection and response (CDR) capabilities to monitor for deviations from baseline functional behavior, specifically focusing on cross-account permission modifications and unauthorized resource discovery.\u003c/li\u003e\n\u003cli\u003eDeploy SQL-based heuristic logic to track identities identified as administrators or DevOps roles and alert on high-risk operations such as \u003ccode\u003eDeleteBucket\u003c/code\u003e or \u003ccode\u003eModifyRolePolicy\u003c/code\u003e when originating from unusual behavioral clusters.\u003c/li\u003e\n\u003cli\u003eReview the list of Cortex XDR/XSIAM alerts identified in the research to prioritize the enablement of telemetry covering cloud administration commands (T1651) and account manipulation (T1098.003).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-14T12:57:59Z","date_published":"2026-09-14T12:57:59Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cloud-identity-clustering/","summary":"Security researchers have developed a behavioral clustering model using unsupervised machine learning to differentiate between legitimate cloud functional roles and attackers masquerading as authorized identities.","title":"Detecting Identity Masquerading via Behavioral Clustering","url":"https://feed.craftedsignal.io/briefs/2026-09-cloud-identity-clustering/"}],"language":"en","title":"CraftedSignal Threat Feed - Behavior-Analysis","version":"https://jsonfeed.org/version/1.1"}