Wiz has introduced two AI-driven agents — the Red Agent and Blue Agent — designed to fundamentally shift Security Operations Center (SOC) teams from reactive alert triage to proactive threat neutralization in cloud environments. The announcement addresses a pain point every SOC leader knows intimately: cloud security tooling generates overwhelming volumes of findings, but the vast majority lack the exploit-path validation and attack context analysts need to distinguish a theoretical risk from an imminent breach.
The Red Agent simulates attacker behavior against your cloud environment, validating which vulnerabilities and misconfigurations are actually exploitable — producing what Wiz calls "validated pre-breach alerts." The Blue Agent takes the other side of the engagement: when an active threat is detected, it autonomously investigates at machine speed, mapping the full attack path, correlating telemetry across cloud control planes and workloads, and delivering an actionable incident narrative to the SOC.
This matters now because adversaries are already operating at machine speed. The same AI capabilities that power these defenders are being weaponized by threat actors to accelerate reconnaissance, exploit chaining, and lateral movement in cloud environments. If your detection-to-containment timeline is measured in hours while the attacker's dwell-to-impact window is measured in minutes, you have already lost. This post breaks down what these agents do, why the underlying defensive principles apply regardless of your tooling, and how to operationalize AI-augmented detection and response in your own SOC.
Technical Analysis: What Red and Blue Agents Actually Do
Red Agent: Attack Simulation for Pre-Breach Validation
The Red Agent functions as an autonomous offensive validation engine operating against your cloud environment. Rather than generating another static findings list, it actively evaluates whether a given misconfiguration, exposed credential, overly permissive IAM role, or unpatched workload can be chained into a viable attack path. This is the critical distinction: a medium-severity vulnerability on an internet-facing instance with an over-privileged service account attached to a sensitive S3 bucket is not a medium risk — it is a breach path. Red Agent validates these paths before an attacker finds them.
From a practitioner's standpoint, this is continuous automated red teaming focused on cloud-native attack surfaces: identity chains, network exposure, secrets exposure, container escape paths, and serverless function abuse. The output is not a CVSS score — it is a validated, contextualized attack path with evidence of exploitability.
Blue Agent: Machine-Speed Threat Investigation
The Blue Agent operates post-detection. When a threat signal fires — whether from Wiz's own runtime sensors, cloud provider audit logs, or third-party detection tooling — the Blue Agent autonomously investigates the alert. It correlates the initial signal against cloud control-plane telemetry (CloudTrail, Azure Activity Log, GCP Audit Logs), workload runtime data, identity activity, and network flow logs to build a complete incident narrative.
This directly attacks the mean time to investigate (MTTI) problem. In most SOCs, a skilled analyst investigating a cloud compromise must pivot across 3-5 different consoles, manually correlate timestamps across log sources with inconsistent formats, and reconstruct the attack chain by hand. The Blue Agent compresses this from hours to minutes by performing the correlation autonomously and presenting the SOC analyst with a validated incident narrative: what happened, what was touched, what the blast radius is, and what needs to be contained.
Why This Architecture Matters for Defenders
The Red/Blue Agent model mirrors the adversarial duality that effective security programs have always relied on: you need offensive validation to prioritize what actually matters (pre-breach), and you need rapid, thorough investigation to contain what gets through (post-breach). Automating both sides of this loop is not about replacing analysts — it is about ensuring analysts spend their time on decision-making and containment rather than log pivoting and false-positive triage.
The broader industry context makes this urgent. Cloud environments are being targeted through identity-based attack chains (OAuth token theft, service account abuse, federation misconfigurations), supply-chain compromise of container images and CI/CD pipelines, and exploitation of internet-facing cloud workloads. Threat actors are using AI to automate reconnaissance and initial access at scale. Defenders who are still manually triaging cloud alerts are operating at a fundamental speed disadvantage.
Detection & Response
Threat Landscape Context
While this announcement is about defensive tooling, the underlying threat model is clear: cloud environments face identity-driven attacks, lateral movement via over-privileged service accounts, and exploitation of publicly exposed workloads. The detections below target the attack techniques that AI-augmented adversaries are executing against cloud control planes and workloads — the same techniques that the Red Agent simulates and the Blue Agent investigates.
SIGMA Detection Rules
The following Sigma rules target cloud-native attack behaviors observable in endpoint and identity telemetry that commonly precede or accompany cloud compromise — credential dumping, suspicious cloud CLI usage, and anomalous identity enumeration.
---
title: Cloud Credential Theft via Instance Metadata Service Abuse
id: 8f2e4a91-3c7b-4d56-ae19-5b6c7d8e9f01
status: experimental
description: Detects process-level access to cloud instance metadata endpoints from unexpected processes, a common technique for stealing temporary IAM credentials from EC2, Azure VM, or GCP compute instances.
references:
- https://attack.mitre.org/techniques/T1552/005/
- https://attack.mitre.org/techniques/T1078/004/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.credential_access
- attack.t1552.005
- attack.t1078.004
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIp:
- '169.254.169.254'
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\curl.exe'
- '\certutil.exe'
- '\cmd.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
filter_known_agents:
Image|endswith:
- '\amazon-ssm-agent.exe'
- '\WindowsAzureGuestAgent.exe'
- '\google_osconfig_agent.exe'
- '\GCEWindowsAgent.exe'
condition: selection and not filter_known_agents
falsepositives:
- Legitimate cloud management agents (filtered above)
- Infrastructure-as-code deployment scripts using metadata for configuration
- Approved monitoring agents querying instance metadata for tagging
level: high
---
title: Suspicious Cloud CLI Enumeration and Privilege Escalation Attempts
id: 3a9b5c12-7d4e-4f18-b023-6c8d9e1f2a34
status: experimental
description: Detects execution of cloud CLI tools (aws, az, gcloud) with enumeration or privilege escalation commands from non-standard execution contexts, indicating potential attacker reconnaissance or lateral movement via cloud identity.
references:
- https://attack.mitre.org/techniques/T1087/004/
- https://attack.mitre.org/techniques/T1069/003/
- https://attack.mitre.org/techniques/T1078/004/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.discovery
- attack.t1087.004
- attack.t1069.003
logsource:
category: process_creation
product: windows
detection:
selection_aws:
Image|endswith: '\aws.exe'
CommandLine|contains:
- 'iam list-users'
- 'iam list-roles'
- 'iam list-attached-role-policies'
- 'iam get-policy'
- 'sts get-caller-identity'
- 'secretsmanager list-secrets'
- 'ssm describe-instance-information'
- 'ec2 describe-instances'
- 's3 ls'
- 'lambda list-functions'
- 'organizations list-accounts'
selection_azure:
Image|endswith: '\az.cmd'
CommandLine|contains:
- 'ad user list'
- 'ad sp list'
- 'role assignment list'
- 'keyvault list'
- 'storage account list'
- 'vm list'
- 'account list-locations'
selection_gcloud:
Image|endswith:
- '\gcloud.cmd'
- '\gcloud'
CommandLine|contains:
- 'iam service-accounts list'
- 'projects list'
- 'compute instances list'
- 'secrets list'
- 'storage buckets list'
- 'iam roles list'
filter_parent:
ParentImage|endswith:
- '\terraform.exe'
- '\pulumi.exe'
- '\code.exe'
- '\idea64.exe'
condition: 1 of selection_* and not filter_parent
falsepositives:
- DevOps engineers running infrastructure queries (filter by parent process and user context)
- Infrastructure-as-code tooling during legitimate deployments
- Cloud security posture management (CSPM) scanning tools
level: medium
---
title: Potential OAuth Token Theft or Consent Phishing Artifact Creation
id: 5c1d8e34-2f6a-4b79-cd45-7e9f1a3b5c67
status: experimental
description: Detects creation of suspicious OAuth application registrations or service principal credential additions in Azure AD / Entra ID audit telemetry forwarded to SIEM, a common cloud persistence and privilege escalation technique.
references:
- https://attack.mitre.org/techniques/T1550/001/
- https://attack.mitre.org/techniques/T1136/003/
- https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1136.003
- attack.t1098.001
- attack.credential_access
- attack.t1550.001
logsource:
category: process_creation
product: windows
detection:
selection_graph:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- 'New-MgApplication'
- 'New-AzureADApplication'
- 'New-MgServicePrincipal'
- 'Add-MgApplicationPassword'
- 'Add-MgServicePrincipalPassword'
- 'New-AzureADServiceAppRoleAssignment'
- 'Add-AzureADApplicationPassword'
- 'Add-AzureADServicePrincipalPassword'
selection_azcli:
Image|endswith: '\az.cmd'
CommandLine|contains:
- 'ad app create'
- 'ad sp create'
- 'ad app credential reset'
- 'ad sp credential reset'
filter_admin_context:
CommandLine|contains:
- '-WhatIf'
- '--dry-run'
condition: 1 of selection_* and not filter_admin_context
falsepositives:
- Identity administrators performing legitimate application registrations
- CI/CD pipelines automating application deployment and service principal management
- Use change management correlation to distinguish authorized activity
level: high
KQL Hunt Query: Cloud Identity Attack Chain Detection (Microsoft Sentinel / Defender)
This KQL query hunts for the multi-stage cloud identity attack pattern — suspicious authentication followed by privilege escalation and resource enumeration — across Microsoft Defender for Endpoint and Entra ID audit data ingested into Sentinel. The pattern mirrors what a threat actor executing identity-based cloud attacks would produce and what the Wiz Blue Agent would investigate autonomously.
// Hunt: Cloud Identity Attack Chain — Suspicious Auth → Privilege Escalation → Enumeration
// Correlates risky sign-ins with subsequent privilege escalation and cloud resource enumeration
// Tuning: Adjust the TimeWindow for your environment's baseline. 4h is a reasonable starting point.
let TimeWindow = 4h;
let SuspiciousSignIns = SigninLogs
| where TimeGenerated > ago(24h)
| where RiskLevelDuringSignIn in ("high", "medium")
or ResultType != 0
| where AppDisplayName has_any ("Azure Portal", "Azure CLI", "Azure PowerShell", "Microsoft Graph")
| summarize SuspiciousAuthTime = min(TimeGenerated),
AuthCount = count(),
SourceIPs = make_set(IPAddress),
UserAgents = make_set(UserAgent)
by UserPrincipalName, bin(TimeGenerated, 1h);
let PrivilegeEscalation = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has_any (
"Add member to role",
"Add eligible member to role",
"Add service principal credentials",
"Add app role assignment to service principal",
"Consent to application"
)
| mv-expand TargetResources
| extend TargetUser = tostring(TargetResources.userPrincipalName)
| extend ModifiedProperties = TargetResources.modifiedProperties
| summarize PrivEscTime = min(TimeGenerated),
Operations = make_set(OperationName)
by InitiatedBy = tostring(parse_json(InitiatedBy).user.userPrincipalName), TargetUser;
let CloudEnumeration = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine has_any (
"az ad user list", "az ad sp list", "az role assignment list",
"az keyvault list", "az storage account list", "az vm list",
"aws iam list-users", "aws iam list-roles", "aws secretsmanager list-secrets",
"gcloud iam service-accounts list", "gcloud projects list"
)
| summarize EnumTime = min(TimeGenerated),
Commands = make_set(ProcessCommandLine),
Devices = make_set(DeviceName)
by InitiatingProcessAccountName;
SuspiciousSignIns
| join kind=inner (
PrivilegeEscalation
) on $left.UserPrincipalName == $right.InitiatedBy
| where PrivEscTime between (SuspiciousAuthTime .. SuspiciousAuthTime + TimeWindow)
| join kind=leftouter (
CloudEnumeration
) on $left.UserPrincipalName == $right.InitiatingProcessAccountName
| where isnull(EnumTime) or EnumTime between (SuspiciousAuthTime .. SuspiciousAuthTime + TimeWindow)
| project UserPrincipalName, SuspiciousAuthTime, SourceIPs, AuthCount,
PrivEscTime, Operations, TargetUser,
EnumTime, Commands, Devices
| order by SuspiciousAuthTime desc
Velociraptor VQL: Cloud Workload Compromise Artifact Hunt
This VQL artifact hunts for evidence of cloud credential theft and attacker tooling on cloud workloads — targeting credential file access, cloud CLI artifacts, and suspicious process execution patterns commonly observed during cloud post-exploitation.
-- Hunt: Cloud Credential and Post-Exploitation Artifact Detection
-- Searches for suspicious access to cloud credential stores, cloud CLI execution,
-- and common post-exploitation tooling on cloud workloads
LET cloud_cred_paths = {
"windows": [
"C:/Users/*/.aws/credentials",
"C:/Users/*/.aws/config",
"C:/Users/*/.azure/",
"C:/Users/*/.config/gcloud/",
"C:/Windows/System32/config/systemprofile/.aws/credentials",
"C:/Windows/System32/config/systemprofile/.azure/"
],
"linux": [
"/home/*/.aws/credentials",
"/home/*/.aws/config",
"/home/*/.azure/",
"/home/*/.config/gcloud/",
"/root/.aws/credentials",
"/root/.azure/",
"/var/lib/*/.aws/credentials"
]
};
LET suspicious_processes = pslist() WHERE {
CommandLine =~ '(aws|az|gcloud|gsutil).*(list|describe|get|ls|cat|cp|sync)'
AND CommandLine =~ '(secret|credential|password|token|key|iam|role|policy)'
};
LET cred_file_access = SELECT
FullPath,
Size,
Mtime AS ModifiedTime,
Atime AS AccessTime
FROM glob(globs=cloud_cred_paths.linux)
WHERE Mtime > now() - 86400*7;
LET suspicious_connections = SELECT
Pid,
Name,
RemoteAddr,
RemotePort,
Status
FROM netstat()
WHERE RemoteAddr =~ '169\\.254\\.169\\.254'
AND NOT Name =~ '(ssm-agent|google|azure|amazon|waagent|cloud-init)';
SELECT 'Suspicious Cloud CLI Process' AS ArtifactType,
Pid, Name, CommandLine, Exe, Username, CreateTime
FROM suspicious_processes
UNION ALL
SELECT 'Cloud Credential File Recently Modified' AS ArtifactType,
NULL AS Pid, NULL AS Name, FullPath AS CommandLine, NULL AS Exe,
NULL AS Username, ModifiedTime AS CreateTime
FROM cred_file_access
UNION ALL
SELECT 'IMDS Access from Non-Standard Process' AS ArtifactType,
Pid, Name, RemoteAddr AS CommandLine, NULL AS Exe,
NULL AS Username, NULL AS CreateTime
FROM suspicious_connections
Remediation Script: Cloud Identity Hardening Verification
#Requires -Modules Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Applications, Microsoft.Graph.Identity.DirectoryManagement
#Requires -RunAsAdministrator
<#
.SYNOPSIS
Cloud Identity Attack Surface Assessment and Hardening Script
.DESCRIPTION
Audits Entra ID (Azure AD) for common attack surface indicators that
AI-augmented threat actors exploit: risky service principals, stale
credentials, overly permissive app registrations, and consent grants.
Run this regularly as part of your cloud identity hygiene program.
.NOTES
Security Arsenal - Cloud Identity Hardening
Requires: Microsoft Graph PowerShell SDK, Cloud Application Administrator or higher
#>
$ReportPath = "$env:USERPROFILE\Desktop\CloudIdentityAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$Findings = @()
# Connect with minimum required scopes
Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","AuditLog.Read.All","Policy.Read.All" -NoWelcome
Write-Host "[*] Auditing service principals with credentials expiring beyond 180 days..." -ForegroundColor Cyan
$ServicePrincipals = Get-MgServicePrincipal -All -Property "DisplayName,KeyCredentials,PasswordCredentials,AppRoleAssignments"
foreach ($SP in $ServicePrincipals) {
foreach ($Cred in $SP.PasswordCredentials) {
if ($Cred.EndDateTime -and $Cred.EndDateTime -gt (Get-Date).AddDays(180)) {
$Findings += [PSCustomObject]@{
Finding = "Long-lived service principal secret"
Object = $SP.DisplayName
ObjectId = $SP.Id
Detail = "Secret expires: $($Cred.EndDateTime) — exceeds 180-day policy"
Severity = "High"
Recommendation = "Rotate secret and enforce maximum 180-day credential lifetime"
}
}
}
foreach ($KeyCred in $SP.KeyCredentials) {
if ($KeyCred.EndDateTime -and $KeyCred.EndDateTime -gt (Get-Date).AddDays(365)) {
$Findings += [PSCustomObject]@{
Finding = "Long-lived service principal certificate"
Object = $SP.DisplayName
ObjectId = $SP.Id
Detail = "Certificate expires: $($KeyCred.EndDateTime) — exceeds 365-day policy"
Severity = "Medium"
Recommendation = "Rotate certificate and enforce maximum 365-day credential lifetime"
}
}
}
}
Write-Host "[*] Auditing application registrations with excessive permissions..." -ForegroundColor Cyan
$HighRiskScopes = @("Mail.Read","Mail.ReadWrite","Files.ReadWrite.All","Sites.FullControl.All","Directory.ReadWrite.All","RoleManagement.ReadWrite.Directory")
$Apps = Get-MgApplication -All -Property "DisplayName,RequiredResourceAccess,PasswordCredentials,SignInAudience"
foreach ($App in $Apps) {
foreach ($RRA in $App.RequiredResourceAccess) {
foreach ($RA in $RRA.ResourceAccess) {
if ($RA.Id -in $HighRiskScopes) {
$Findings += [PSCustomObject]@{
Finding = "Application with high-risk API permission"
Object = $App.DisplayName
ObjectId = $App.Id
Detail = "Permission ID: $($RA.Id) — review necessity"
Severity = "High"
Recommendation = "Remove unnecessary permissions; apply least-privilege principle"
}
}
}
}
}
Write-Host "[*] Checking for applications allowing multi-tenant access..." -ForegroundColor Cyan
foreach ($App in $Apps) {
if ($App.SignInAudience -eq "AzureADMultipleOrgs") {
$Findings += [PSCustomObject]@{
Finding = "Multi-tenant application registration"
Object = $App.DisplayName
ObjectId = $App.Id
Detail = "SignInAudience: AzureADMultipleOrgs — accessible from external tenants"
Severity = "Medium"
Recommendation = "Restrict to single tenant unless multi-tenant access is explicitly required"
}
}
}
Write-Host "[*] Auditing risky OAuth consent grants from last 30 days..." -ForegroundColor Cyan
$ConsentAudits = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ')) and activityDisplayName eq 'Consent to application'" -All
foreach ($Audit in $ConsentAudits) {
$Findings += [PSCustomObject]@{
Finding = "Recent OAuth consent grant"
Object = ($Audit.TargetResources | Select-Object -First 1).DisplayName
ObjectId = ($Audit.TargetResources | Select-Object -First 1).Id
Detail = "Initiated by: $($Audit.InitiatedBy.User.UserPrincipalName) on $($Audit.ActivityDateTime)"
Severity = "Medium"
Recommendation = "Verify consent was authorized; review granted permissions"
}
}
Write-Host "`n[*] Audit complete. $($Findings.Count) findings." -ForegroundColor Green
if ($Findings.Count -gt 0) {
$Findings | Sort-Object Severity | Format-Table -AutoSize
$Findings | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "[*] Report exported to: $ReportPath" -ForegroundColor Green
} else {
Write-Host "[+] No findings detected. Environment follows cloud identity hardening best practices." -ForegroundColor Green
}
Disconnect-MgGraph | Out-Null
Remediation: Operationalizing Proactive Cloud Defense
Whether you adopt Wiz's Red and Blue Agents or build equivalent capabilities with your existing tooling, the following actions move your SOC from reactive to proactive cloud defense.
Immediate Actions (This Week)
-
Inventory your cloud attack surface. Enumerate all internet-facing cloud resources, identify over-privileged IAM roles and service accounts, and flag workloads running end-of-life or unpatched images. Use your CSPM or cloud-native tools (AWS Config, Azure Defender for Cloud, GCP Security Command Center) to generate this baseline. The Red Agent's core value is automating this — but you can start manually today.
-
Audit cloud credential hygiene. Run the PowerShell assessment script above (or equivalent for your cloud provider) to identify long-lived credentials, excessive permissions, and stale service principals. Rotate any credentials older than 90 days. Enforce maximum credential lifetimes via organizational policy.
-
Enable and centralize cloud audit logging. Confirm that CloudTrail (all regions, including management and data events), Azure Activity Log, and GCP Audit Logs are enabled, immutable, and flowing to your SIEM. Without centralized cloud telemetry, neither AI agents nor human analysts can investigate effectively.
Short-Term Hardening (30 Days)
-
Deploy runtime threat detection on cloud workloads. Static posture management alone is insufficient. Deploy eBPF-based or agent-based runtime detection (Wiz Runtime Sensor, Falco, AWS GuardDuty, Microsoft Defender for Cloud) to detect active exploitation attempts, cryptominers, and reverse shells on cloud workloads.
-
Implement identity-first detection rules. Deploy the Sigma rules and KQL queries provided in this post. Focus on the identity attack chain: anomalous authentication → privilege escalation → resource enumeration → data access. This chain is where the majority of cloud breaches unfold.
-
Establish cloud incident response playbooks. Your on-premises IR playbook does not translate directly to cloud incidents. Build playbooks for: compromised IAM credentials, malicious OAuth consent grants, exposed storage buckets, container escape, and supply-chain compromise of container images. Test them with tabletop exercises that simulate the machine-speed timelines the Blue Agent is designed to address.
Strategic Shift (90 Days)
-
Evaluate AI-augmented SOC capabilities. Whether through Wiz Red/Blue Agents, Microsoft Security Copilot, or equivalent tooling, assess how AI-driven investigation and validation can reduce your MTTI and mean time to respond (MTTR). The key metric: can your team go from alert to validated incident narrative with full attack path mapping in under 15 minutes? If not, you have a speed gap that AI augmentation can close.
-
Adopt continuous attack path validation. Move beyond point-in-time penetration tests. Implement continuous validation of exploitable attack paths in your cloud environment — either through automated tooling like the Red Agent or through scheduled purple team exercises that chain misconfigurations into viable breach scenarios.
-
Measure what matters. Track MTTI, MTTR, and the ratio of validated actionable alerts to total findings. If your team is drowning in unvalidated findings with no exploit-path context, you are operating reactively regardless of how many tools you have deployed. The Red/Blue Agent model — or any equivalent capability — should measurably shift this ratio toward validated, actionable intelligence.
Conclusion
The Wiz Red and Blue Agents represent a broader industry inflection point: the recognition that cloud defense at human speed is no longer sufficient against adversaries operating at machine speed. The specific tooling matters less than the operating model — continuous offensive validation of attack paths (pre-breach) paired with autonomous, machine-speed investigation of active threats (post-breach). SOC teams that adopt this dual-agent model, whether through Wiz or equivalent capabilities, will close the speed gap that adversaries are currently exploiting. Those that continue manual triage of unvalidated findings will find themselves perpetually behind the threat.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.