Last reviewed:

Cloud threat hunting is the proactive practice of searching cloud environments for attacker activity that automated security tools have not detected. Security teams examine cloud logs, identity activity, API calls, network traffic, workloads and configuration changes for signs of compromise, persistence, privilege escalation or data theft.

Cloud threat hunting applies to Amazon Web Services (AWS), Microsoft Azure, Google Cloud, SaaS applications, hybrid environments and Kubernetes clusters. It complements automated detection by looking for suspicious behavior that may not match a known signature or trigger an alert.

Cloud Threat Hunting at a Glance

Attribute Description
Primary goal Find hidden or early-stage threats before they cause greater damage
Main approach Hypothesis-driven investigation of cloud telemetry
Typical targets Identities, APIs, storage, databases, workloads, containers and control planes
Key data Audit logs, sign-in logs, API activity, network flows, endpoint telemetry and workload logs
Common tools SIEM, XDR, CNAPP, cloud-native security services and query languages such as KQL
Typical output A confirmed incident, a new detection rule, improved visibility or a remediated control gap

How Is Cloud Threat Hunting Different From Normal Cloud Security Monitoring?

Cloud security monitoring waits for events, rules or analytics to generate alerts. Cloud threat hunting actively searches for suspicious activity, including activity that has not triggered an alert.

Cloud threat hunting does not replace monitoring, vulnerability management or incident response. It addresses a different question: could an attacker already be operating in the environment without being detected?

Security activity Main question
Cloud security posture management Which cloud resources are exposed or misconfigured?
Vulnerability management Which software or services contain exploitable weaknesses?
Security monitoring Did a configured detection rule identify suspicious activity?
Incident response How should the organization contain and remediate a suspected incident?
Cloud threat hunting Is an attacker already operating in the environment without being detected?

Microsoft describes threat hunting as useful during proactive, reactive and post-incident stages. A hunt can search for undetected threats, support an active investigation or identify detection gaps after an incident.

Why Does Cloud Threat Hunting Matter?

Cloud environments give attackers powerful legitimate capabilities. A compromised user, service principal, access key or managed identity may let an attacker use normal cloud APIs instead of deploying obvious malware.

An attacker with a valid cloud account may:

  • Enumerate accounts, roles, services and resources.
  • Create a new access key, service principal or OAuth application.
  • Change identity and access management permissions.
  • Access storage buckets, databases or collaboration platforms.
  • Create compute resources for cryptocurrency mining.
  • Disable or alter logging and security controls.
  • Download large volumes of sensitive data.
  • Move between cloud tenants, subscriptions, accounts or workloads.

MITRE ATT&CK classifies compromised cloud accounts as a technique that adversaries can use for initial access, persistence, privilege escalation and defense evasion. MITRE also identifies cloud service discovery and cloud infrastructure discovery as common attacker objectives.

Investigating this activity can be difficult because the evidence may be spread across identity providers, cloud control planes, SaaS applications, virtual machines, containers and application platforms.

How Does Cloud Threat Hunting Work?

A cloud threat hunt usually follows six steps.

1. Define a Hunting Hypothesis

The security analyst starts with a specific question, such as:

Could an attacker be using a compromised privileged account to enumerate cloud resources and access sensitive storage?

A hypothesis may come from threat intelligence, a new attacker technique, an unusual event, a recent incident or a known weakness in the organization's environment.

2. Identify the Required Telemetry

The analyst determines which data sources can confirm or disprove the hypothesis. A hunt for compromised identities may require sign-in logs, API activity, role changes, service principal activity and access records for sensitive resources.

A hunt for container compromise may require Kubernetes audit logs, container runtime events, cloud control-plane activity and network telemetry.

3. Search and Correlate Events

Threat hunters use queries, filters and analytics to search large volumes of data. They correlate activity by identity, IP address, device, application, resource, session, timestamp and geographic location.

Microsoft Defender's advanced hunting capability uses Kusto Query Language, or KQL, to search security data and investigate known or potential threats. Analysts can also convert successful queries into custom detection rules.

4. Investigate Suspicious Activity

A suspicious event is not automatically malicious. The analyst compares it with normal business behavior and approved changes.

For example, a new privileged role assignment may be legitimate if it matches a change ticket. The same assignment becomes more suspicious when it occurs alongside an unfamiliar sign-in, a new access key and large-scale storage downloads.

5. Contain and Remediate the Threat

If the evidence indicates compromise, the security team may revoke tokens, disable credentials, isolate workloads, remove unauthorized permissions, block malicious network activity or restore logging.

6. Improve Detections and Controls

A completed hunt should produce more than an incident report. Teams can use the findings to create detection rules, improve log coverage, reduce false positives and close identity or configuration gaps.

What Data Sources Are Used in Cloud Threat Hunting?

Effective hunting depends on complete, reliable telemetry. Important data sources include:

Environment Important data sources What the data can show
AWS AWS CloudTrail, IAM activity, VPC Flow Logs, workload and application logs API calls, identity use, resource changes, network connections and access to cloud services
Microsoft Azure Azure Activity Log, Microsoft Entra sign-in and audit logs, Microsoft Defender for Cloud, Microsoft Sentinel and workload logs Subscription changes, authentication, service principal activity, role changes and cloud workload threats
Google Cloud Cloud Audit Logs, IAM activity, VPC Flow Logs, Security Command Center findings and workload logs Administrative changes, data access, policy denials, resource activity and identity behavior
Kubernetes Kubernetes audit logs, control-plane logs, container runtime telemetry and network data API requests, changes to pods and workloads, administrator actions and suspicious cluster activity
SaaS platforms Authentication, administrative, file access and application activity logs Account takeover, unusual downloads, external sharing, application consent and data access

AWS CloudTrail records AWS API activity, including the identity, time, source IP address, request parameters and response information associated with an API call.

Google Cloud Audit Logs record administrative activity, data access, system events and policy denials. Google states that Data Access audit logs are disabled by default for many services and may create additional logging charges when enabled.

Microsoft Entra audit logs record changes to users, groups, applications and licenses. Microsoft Entra sign-in logs provide information about the identity, client application and resource involved in a sign-in.

Kubernetes audit logs provide a chronological record of actions performed by users, applications and the control plane. The records can show who initiated an action, what resource it affected and when it occurred.

What Do Cloud Threat Hunters Look For?

Cloud threat hunting focuses on behavior and relationships rather than isolated indicators. Common hunting scenarios include:

Compromised Cloud Accounts

Analysts search for:

  • Sign-ins from unusual locations or devices.
  • Privileged accounts accessing unfamiliar services.
  • API calls outside an identity's normal scope.
  • Interactive and non-interactive sign-ins occurring in unusual patterns.
  • Service principals or managed identities accessing resources they do not normally use.

Privilege Escalation

Hunters investigate:

  • New administrator or owner assignments.
  • Changes to role-assumption policies.
  • New service principals or application credentials.
  • Permission changes made outside normal processes.
  • Long-lived access keys created for privileged identities.

Cloud Reconnaissance

Attackers may enumerate accounts, services, storage, virtual machines, databases or network configurations before taking further action. Analysts can search for unusually broad or rapid resource discovery through cloud APIs.

MITRE ATT&CK identifies cloud service discovery and cloud infrastructure discovery as relevant attacker techniques.

Data Access and Exfiltration

Useful hunting questions include:

  • Did an identity download an unusual volume of files?
  • Did a user create external shares for sensitive data?
  • Did a cloud workload access a database it had never used before?
  • Did an application access storage from an unexpected location?
  • Did data access occur immediately after a privilege or credential change?

Defense Evasion

Threat hunters look for attempts to:

  • Disable or modify cloud logging.
  • Change retention or export settings.
  • Remove security agents.
  • Alter alerting policies.
  • Create exclusions that hide activity.
  • Delete evidence or modify audit configurations.

Workload and Container Abuse

Hunts may investigate:

  • Unexpected shell access to a container.
  • New privileged containers.
  • Kubernetes role changes.
  • Access to container secrets.
  • Unusual outbound connections.
  • New compute instances running cryptocurrency miners or unauthorized tools.

Microsoft Defender for Cloud provides threat detection across servers, storage, containers, databases, APIs and other cloud workloads. Its examples include brute-force activity, unusual data extraction, web shells and cryptocurrency mining.

Which Tools Support Cloud Threat Hunting?

A cloud threat hunting capability commonly combines:

  • SIEM: Centralizes and correlates cloud, identity, endpoint and application data.
  • XDR: Connects related signals across identities, endpoints, email, applications and cloud services.
  • CNAPP: Combines cloud posture, workload, application and runtime security capabilities.
  • Cloud-native detection services: Generate provider-specific findings and alerts.
  • Query tools: Search historical and real-time telemetry with KQL, SQL or provider-specific query languages.
  • Threat intelligence: Supplies indicators, attacker behaviors and current techniques to guide hypotheses.
  • SOAR platforms: Automate containment and remediation actions after a hunt confirms a threat.

Tools are only as effective as the telemetry they receive. A security team cannot reliably hunt for data access, identity abuse or log tampering if the relevant audit logs are missing, retained for too little time or inaccessible.

What Are the Main Limitations of Cloud Threat Hunting?

Cloud threat hunting has four practical limitations.

  1. Incomplete logging creates blind spots. Important data sources may not be enabled, routed to the security team or retained long enough for an investigation.

  2. Cloud activity is highly contextual. A new role assignment, API call or workload may be normal in one organization and suspicious in another.

  3. Logging can create cost and volume challenges. Detailed data-access and workload logs can generate substantial data volumes and may incur additional provider charges.

  4. Human expertise remains necessary. Automation can prioritize events and identify patterns, but analysts still need to understand identity relationships, cloud architecture, application behavior and business context.

What Is the Simplest Definition of Cloud Threat Hunting?

Cloud threat hunting is the deliberate search for attacker behavior in cloud systems before, during or after an alert or security incident. It uses cloud telemetry, threat intelligence, behavioral analysis and analyst investigation to find activity that automated controls may miss.

A practical starting point is to centralize logging for cloud control planes and identity systems, define a small set of high-value hunting hypotheses, and turn successful investigations into repeatable detection rules.