SentinelOne extends Wayfinder coverage across endpoints, identities, and cloud workloads
SentinelOne extended Wayfinder threat hunting to AWS, Azure, and Google Cloud control planes.
SentinelOne expanded Wayfinder Threat Hunting to AWS, Azure, and Google Cloud control planes. The service combines Singularity telemetry with human hunters and intelligence from SentinelOne and Google Threat Intelligence. Coverage includes IAM privilege escalation, unauthorized access, data exfiltration, and hunts such as S3 reconnaissance, root logins, and telemetry destruction. It is generally available to existing Wayfinder customers through Singularity Marketplace plugins.
- Wayfinder Threat Hunting now covers AWS, Azure, and Google Cloud control planes.
- Hunts include IAM escalation, S3 reconnaissance, root logins, and telemetry destruction.
- Findings use SentinelOne and Google Threat Intelligence, with Purple AI summaries.
- Existing Wayfinder customers enable it via Singularity Marketplace cloud plugins.
Full article400 words · extracted from helpnetsecurity.com · click to collapse
SentinelOne has announced the expansion of Wayfinder Threat Hunting to the major public cloud services: AWS, Azure, and Google Cloud. It’s the latest offering from SentinelOne’s Wayfinder team and combines the power of SentinelOne’s AI-powered Singularity Platform telemetry with expert human-led hunting to protect the attack surface across AI, endpoints, identities, and cloud workloads.
The cloud has become an even more attractive attack surface with the rapid adoption of AI. A threat actor who compromises a cloud identity or exploits a misconfiguration can rapidly move directly to data without ever touching an endpoint, often leaving little trace in the logs a security team already watches.
SentinelOne’s Wayfinder Threat Hunting continues to expand to meet attackers wherever they operate: first across the endpoint, then into identity with hunting for Okta and Microsoft Entra ID, and now into the cloud control plane itself. As with all Wayfinder services, this new capability uses threat intelligence and intrusion findings from both SentinelOne and Google Threat Intelligence in a single hunting workflow.
The new Wayfinder Threat Hunting for Cloud gives customers a single, continuous hunting capability across their full environment, giving defenders a decisive operating advantage as their cloud infrastructure spans endpoints, human and agent identities, and the cloud. It provides continuous, expert-led hunting across AWS, Azure, and GCP control-plane activity, with coverage spanning cloud control-plane abuse, IAM privilege escalation, and unauthorized access, and data exfiltration.
Hunts include IAM user enumeration, S3 bucket reconnaissance, root account logins, AKS cluster-admin credential access, suspicious IAM policy changes, AMI deregistration, telemetry destruction, and cross-tenant delegation changes. Curated indicators and behavioral rules are mapped to MITRE ATT&CK techniques, and findings arrive with enriched Purple AI summaries for triage. The result is stronger protection with fewer incidents and less operational overhead.
“Attackers have learned that the fastest and most easily accessible way to an organization’s data is often through the cloud control plane,” said Steve Stone, Chief Customer Officer, SentinelOne. “Extending Wayfinder’s elite hunters into AWS, Azure, and GCP means customers get the same continuous, AI-plus-human scrutiny across their entire footprint to eliminate the gaps in coverage that modern attackers prey on.”
SentinelOne’s Wayfinder Threat Hunting for Cloud is generally available to all existing Wayfinder Threat Hunting customers. Enablement runs through existing Singularity Marketplace plugins for each cloud provider. Customers already leveraging Wayfinder Threat Hunting on identities in Microsoft Entra ID require no additional setup for Azure environments.