Demystifying the Distinction Between Cloud Detection and Cloud Threat Hunting

‍

In cloud security, as in all of cyber, threat detection focuses on identifying malicious activities and security events in real time and generating alerts. The aim is to block threats and attacks before they cause damage. Detection is like a security guard standing watch over a bridge to catch suspicious persons as they pass by.

In contrast, cloud threat hunting involves an analyst proactively investigating historical data to uncover evidence of compromise. Think of a detective scouring the forest behind the bridge to find traces of intruders who have already slipped by unseen.

Metaphors aside, critical technical and operational differences exist:

• Detection relies on streaming live event data and analyzing known threat patterns and behaviors. Hunting leverages comprehensive historical data sets across cloud environments.
• Detection aims to identify known malicious events and generate alerts for Security Operations Center (SOC) analysts. Hunting uncovers previously undetected security threats by searching for anomalous behaviors and activity clusters.
• Detection systems operate automatically using rules and analytics. Hunting can often also involve automated tools as well as tool-assisted investigation by human analysts.

Cloud Threat Hunting is about Investigation

Not all security threats can be blocked or detected in real time for any number of different reasons. In the modern era, attackers often use multi-stage attacks that are designed specifically to evade detection.

For example, something bad may have happened, but it's unclear on the surface what the impact might be. The bad thing could be that somehow a threat adversary was able to gaining an initial level of access into a system. At that point the investigation isn't about what bad things the attacker executed, but rather about how the attacker abused legitimate processes. After all, once an attacker is inside a system with some form of credentials, they are at least from a system perspective, using legitimate privileges that the credentials have been granted.

With that in mind, the goal of a cloud hunting investigation is to answer some important questions such as, what did the attackers do? What was the scope of the attack? And how did they gain access in the first place?

As the attacker is already inside the system, threat prevention tools are not going to be enough as the security team is looking at legitimate actions. That means there is a need for a different level and detail on data than what a Security Information and Event Management (SIEM) would typically ever consider collecting. It also means a very large amount of user behavior data needs to be accessible, correlated, and searchable to enable a forensic investigation.

Effective cloud hunting is about having the right data and being able to sift through it to identify Indicators of Attack (IoAs), that is some form of bad activity that was missed by detection.

Why Cloud Threat Hunting Matters for Modern Enterprises

Cloud threat hunting plays several indispensable roles for today’s cloud- and SaaS-driven enterprises:

‍

Increases visibility
‍Cloud hunting identifies threats missed by real time detection controls due to avoidance tactics, false negatives, or evolving attacker tradecraft.

Uncovers security attacks
Proactively discovers adversaries already present in cloud environments by looking for indicators of compromise across data sources.

Improves threat detection
‍Derive and refine detection rules based on new insights uncovered during hunts.

Builds team knowledge
Security teams learn by studying how cyber attacks impact the organization and how they were remediated.

For these reasons, along with strengthening cloud security posture and organizational resilience overall, cloud threat hunting has become a mandatory capability, not a discretionary line item. Doing it effectively at cloud speed and scale takes specialized capabilities.

Requirements for Effective Cloud Threat Hunting

Attempting threat hunting across modern multi-cloud and SaaS environments quickly exposes daunting complexity. Useful data exists across dozens of APIs, audit logs, third-party services, and custom applications. Making sense of this requires specialized skills, including:

• Broad forensic data collection from all cloud data sources.
• Scalable cloud data lake architecture to retain and aggregate large historical data sets in one place.
• Data normalization and enrichment to ensure consistency across sources and add context.
• Sophisticated query tools and analytics to uncover suspicious patterns and event correlations across terabytes of data.
• Workflow automation and orchestration to execute complex cross-cloud hunts efficiently.

Absent these elements, threat hunting efforts will lack sufficient data or produce excessive noise and false positives.

There is only so much that can be effectively blocked by prevention technologies. With comprehensive data-driven visibility, organizations can monitor effectively, hunt aggressively, and respond decisively across today’s complex cloud environments.

‍