Threat Hunting in Multi-Cloud Environments

Introduction

The ever-expanding attack surface of cloud-native systems introduces sophisticated threats that evade conventional security tooling. In a multi-cloud environment (AWS, Azure, GCP), defenders must combine telemetry, detection rules, behavioral analytics, and threat intelligence to proactively hunt for anomalies.

This blog post provides a detailed technical walkthrough of cloud-native threat hunting strategies, using real-world tools and data sources from the three major cloud platforms, enhanced with Elastic AI, MITRE ATT&CK mappings, Lambda/KQL-based detections, YARA rules, and CI/CD pipeline integration.

Why Cloud Threat Hunting?

Cloud platforms provide immense agility — and equally vast risks. Threat hunting in cloud involves:

  • Correlating activity across heterogeneous services (Compute, Storage, Networking, IAM, Serverless).
  • Detecting unknown or novel threats by exploring logs and anomalies not caught by default rules.
  • Proactively securing environments beyond reactive alerting or SIEM coverage.

Cloud Platforms Covered

We will dive into threat hunting with the following:

Platform Focus Areas Native Security Tools
AWS Serverless (Lambda), IAM, S3, CloudTrail, VPC, GuardDuty CloudTrail, GuardDuty, Security Hub, Detective, AWS Config
Azure AD Identity, Log Analytics, Function Apps, Key Vault, Containers Microsoft Defender XDR, Azure Sentinel, Azure Monitor
GCP IAM, SCC, VPC, Cloud Functions, Pub/Sub, BigQuery Security Command Center, Cloud Audit Logs, Google SecOps

What You’ll Learn

  • How to derive data from native cloud services.
  • How to craft detection rules using:
    • AWS Lambda
    • Azure Kusto Query Language (KQL)
    • YARA rules
  • How to map behaviors to MITRE ATT&CK
  • How to centralize findings in Elastic AI
  • How to embed threat hunting in CI/CD pipelines

Example: Interactive Detection Rule (HTML block)

Below is an example rule written for AWS Lambda to detect overly permissive S3 policies.


def lambda_handler(event, context):
  if event['detail']['eventName'] == "PutBucketPolicy":
    if "Allow": "Everyone" in event['detail']
      ['requestParameters']:
      raise_alert("Public S3 bucket detected")