Amazon Web Services (AWS) has outlined how security teams can improve detection of sophisticated cloud attacks by correlating security signals across identity, storage, network, DNS, and runtime telemetry.
The approach is designed to help defenders move beyond isolated alerts and reconstruct complete attack chains, where seemingly harmless activities become significant when viewed together.
A single cloud security alert may indicate unusual activity, but attackers rarely rely on one action. A compromised credential, for example, can allow threat actors to enumerate cloud resources, discover privileges, move between accounts, access sensitive Amazon S3 data, and ultimately transfer stolen information outside the environment.
By connecting these events across multiple services and time windows, security teams can identify the progression of an intrusion instead of investigating every alert independently.
AWS Reveals Cross-Service Detection
AWS describes a scenario in which an identity invokes GetCallerIdentity from an unfamiliar IP address. Shortly afterward, the same identity could issue large numbers of List, Describe, or Get requests against different AWS services, including failed operations returning AccessDenied.
If these activities are followed by substantial outbound traffic to a newly registered domain, the combination may indicate reconnaissance, privilege exploration, data access, and potential exfiltration.
Amazon GuardDuty can identify many of these signals by analyzing sources such as AWS CloudTrail, Amazon S3 data events, VPC Flow Logs, DNS logs, and runtime telemetry.
GuardDuty Extended Threat Detection can also correlate related activity into a high-severity attack sequence in certain scenarios, including credential compromise followed by data theft.
The resulting investigation can provide security teams with a timeline, MITRE ATT&CK technique mapping, and remediation recommendations.
However, AWS emphasizes that automated detection cannot fully understand an organization’s business context. Security services may identify unusual behavior, but they generally do not know which S3 buckets contain the most sensitive information, which IAM roles are authorized to access them, which role-assumption paths are legitimate, or when production changes are expected.
Adding this context can significantly improve detection accuracy and help distinguish legitimate administrative activity from malicious behavior.
Security teams can create their own correlations using Amazon CloudWatch Logs Insights and telemetry from CloudTrail, VPC Flow Logs, and Route 53 Resolver query logs.
One example involves detecting unusually large numbers of GetObject requests against a sensitive S3 bucket by an unexpected IAM principal.
Analysts can compare the requesting identity against approved access lists and then examine whether the same source generated unusually high outbound network traffic.
AWS notes that CloudTrail data events must be enabled for monitored S3 buckets because management events alone do not capture GetObject activity.
Organizations should also establish behavioral baselines and configure thresholds above normal activity to reduce false positives.
Identity should serve as a primary correlation key, while detection windows should reflect the attack being investigated. Automated reconnaissance may occur within minutes, whereas manual attacker activity can extend across hours or days.
Organizations can further automate response workflows using AWS Lambda, Amazon EventBridge Scheduler, Amazon SNS, and AWS Security Hub.
For large environments, AWS recommends centralizing telemetry through Amazon Security Lake or analyzing long-term records with Amazon Athena. Security data can also be normalized using the Open Cybersecurity Schema Framework (OCSF), making cross-source analysis more consistent.
The broader security lesson is that cloud attacks should not be treated as collections of unrelated events. Correlating identity changes, resource enumeration, sensitive data access, network connections, and DNS activity can reveal the sequence that individual alerts fail to expose.
As cloud environments become increasingly distributed, cross-service signal correlation is becoming an important capability for detecting and responding to multi-stage attacks.
No Comment! Be the first one.