On-prem hunting is about network traffic and process execution. Cloud hunting is about API calls and identity. Every action in AWS, Azure, or GCP is an API call authenticated by an identity. The attacker's footprint is not a binary on disk or a packet on the wire. It is a sequence of API calls made by a compromised identity. If you are not ingesting and analyzing cloud audit logs (CloudTrail, Azure Activity Logs, GCP Cloud Audit Logs), you have no visibility at all.

The IAM complexity problem. Cloud IAM policies are nested, inherited, and frequently over-permissioned. Third-party SaaS integrations get admin-level access for convenience. Service accounts accumulate permissions over years. A single overprivileged identity is the equivalent of leaving a domain admin password on a sticky note.

1. 1. Hunt for credential theft and session hijacking Search for: logins from new or unusual IP ranges, logins without MFA where MFA should be enforced, console logins from API-only service accounts, and session token reuse from different source IPs. Impossible travel detection: a user authenticating from one geography and then from a cloud provider IP in a different region within minutes. CloudTrail: ConsoleLogin · Azure: Sign-in logs · Impossible travel logic on IP geolocation
2. 2. Hunt for shadow admin and privilege escalation An identity with limited permissions using IAM API calls to grant itself elevated access. Search for: iam:CreatePolicyVersion, iam:AttachUserPolicy, iam:PutRolePolicy (AWS), or equivalent Azure/GCP role assignment calls made by non-admin identities. Also check for sts:AssumeRole to roles the identity doesn't normally assume. CloudTrail: eventName=CreatePolicyVersion/AttachUserPolicy by non-admin · Azure: roleAssignments/write
3. 3. Check for data exfiltration via snapshot sharing Attackers copy EBS volume snapshots or RDS database snapshots and share them with an external AWS account under their control. Search for: ModifySnapshotAttribute or ModifyDBSnapshotAttribute calls that add an external account ID, CopySnapshot to a different region, and CreateDBSnapshot followed by sharing. CloudTrail: ModifySnapshotAttribute with add + external accountId · Data Exfil playbook
4. 4. Audit S3/Blob/GCS public exposure and bulk access Search for: bucket policy changes that add public access, PutBucketPolicy or PutBucketAcl with public grants, bulk GetObject calls from a single identity (data harvesting), and ListBuckets from identities that don't normally enumerate storage. Object-level logging (S3 data events) is required to see individual file access. CloudTrail: S3 data events · Azure: Blob diagnostic logs · GCP: Data Access audit logs
5. 5. Hunt for OAuth app consent abuse Attackers register or consent to malicious OAuth apps that inherit user permissions. Search for: new OAuth app registrations, consent grants from compromised accounts (especially "admin consent" that applies org-wide), and OAuth apps with mail.read, files.readwrite, or directory.readwrite permissions. Hybrid AD playbook · Azure AD: App consent audit log · Google Workspace: OAuth token audit
6. 6. Check for resource creation in unexpected regions Attackers create compute instances in regions your organization doesn't use (to avoid monitoring and for cryptomining). Search for: EC2 RunInstances, Azure VM creation, or GCP Compute instance creation in regions outside your approved list. Any resource creation in a non-standard region is suspicious. CloudTrail: RunInstances where awsRegion NOT IN [approved list]
7. 7. Audit cross-account and federation trust Search for: new cross-account IAM roles, SAML/OIDC provider creation or modification, and federation trust changes. Attackers establish persistent cross-account access or modify federation to mint tokens. APT29 specifically targets identity federation (Golden SAML, OAuth abuse). APT29 playbook · CloudTrail: CreateSAMLProvider, UpdateSAMLProvider
8. 8. Monitor for logging and monitoring disruption The first thing a sophisticated cloud attacker does: disable logging. Search for: StopLogging (CloudTrail), DeleteTrail, PutEventSelectors that reduce coverage, GuardDuty detector deletion, and Security Hub disablement. Any modification to the logging pipeline is a critical alert. CloudTrail: StopLogging / DeleteTrail / UpdateTrail · GuardDuty: DeleteDetector

CloudTrail / Azure Activity Logs / GCP Cloud Audit Logs. Management events (API calls that modify resources) are the minimum. Data events (S3 object access, Lambda invocations) are required for data exfiltration detection. Store logs externally in a locked-down account that the primary account can't modify.

Identity logs. Azure AD/Entra ID sign-in logs, AWS IAM Access Analyzer, GCP IAM audit logs. Correlate identity activity across cloud providers if you are multi-cloud.

Network flow logs. VPC Flow Logs (AWS), NSG Flow Logs (Azure), VPC Flow Logs (GCP). Required for detecting lateral movement between cloud resources and unexpected egress.

Hybrid AD Enterprise (cloud identity is the bridge between on-prem and cloud)
APT29 / Cozy Bear (cloud-focused post-compromise and OAuth abuse)
Compromised Credentials (cloud credential theft is the #1 cloud attack vector)
Kubernetes and Container (K8s runs on cloud infrastructure with shared IAM)