Amazon GuardDuty Extended Threat Detection Adds Five New Attack Sequence Indicators

Expanded Threat Detection Capabilities

Amazon GuardDuty Extended Threat Detection has integrated five new indicator types into its attack sequence findings. These new indicators are MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. This expansion aims to enhance the service's ability to identify and prioritize credible attack sequences by correlating previously weak signals.

Integration with Existing AWS Security Services

The new indicators derive signals from other AWS security services, including Amazon Inspector, Amazon Virtual Private Cloud (Amazon VPC) Reachability Analyzer, Amazon Macie, and posture data from AWS Security Hub. By folding these signals into attack sequence findings, GuardDuty can provide a more comprehensive view of potential threats. This integration allows organizations already using these prerequisite services to gain additional value from their existing security infrastructure.

Prioritizing High-Confidence Findings

The primary purpose of these new indicators is to help Extended Threat Detection prioritize the most critical signals within an AWS account. By correlating these weak signals, which individually might not indicate a clear threat, GuardDuty can generate higher-confidence findings. This is particularly relevant for monitoring runtime activity on Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Container Service (Amazon ECS), and Amazon Elastic Kubernetes Service (Amazon EKS) workloads, contributing to a more active defense strategy.

Indicator Details and EPSS Score

In GuardDuty, a 'signal' is any event evaluated for suspicious activity, with 'weak signals' not clearly pointing to a threat on their own. The five new indicators fall into this category. For instance, a Common Vulnerabilities and Exposures (CVE) finding indicates a vulnerability but not necessarily an active exploit. These indicators are displayed on the Indicators tab of attack-sequence findings in the AWS Management Console and in the GetFindings JSON file. The VULNERABILITY indicator includes an EPSS (Exploit Prediction Scoring System) score, which represents the probability of a published CVE being exploited in the wild within 30 days, ranging from 0 to 1.