Detecting Multi-Stage Attacks on AWS: A Guide to Cross-Service Signal Correlation
This AWS Security Blog post guides security engineers and operations teams on detecting multi-stage attacks by correlating signals across AWS security services. It explains how to combine foundational AWS detection services with specific business context to build a unified view of attack sequences. The article details how Amazon GuardDuty Extended Threat Detection automatically correlates universal patterns and demonstrates building custom, environment-specific detections using Amazon CloudWatch Logs Insights. It includes prerequisites and example queries for practical implementation.
- →Introduction to Multi-Stage Attack Detection
- →Foundational AWS Detection Services
- →Amazon GuardDuty Extended Threat Detection
- →Incorporating Business Context for Custom Detections
- →Mapping Attack Phases to AWS Log Sources
Notes (6) ›
- Introduction to Multi-Stage Attack Detection
The post introduces the concept of correlating signals from various AWS security services with business context to detect multi-stage attacks, offering a unified view beyond individual alerts.
- Foundational AWS Detection Services
It outlines key AWS services like Amazon GuardDuty, Amazon Detective, AWS Security Hub, Amazon Security Lake, and Amazon Inspector as starting points for comprehensive threat detection.
- Amazon GuardDuty Extended Threat Detection
The article explains how GuardDuty Extended Threat Detection automatically correlates signals across multiple data sources to identify universal multi-stage attack patterns, mapping them to MITRE ATT&CK tactics.
- Incorporating Business Context for Custom Detections
It details how security teams can add environment-specific business context to create custom detection layers, providing example queries to run in Amazon CloudWatch Logs Insights.
- Mapping Attack Phases to AWS Log Sources
The post maps the five phases of multi-stage attacks (initial access, discovery, privilege escalation, lateral movement, exfiltration) to corresponding signals found in AWS CloudTrail, VPC Flow Logs, and Route 53 Resolver query logs.
- Example: Sensitive Data Access by Unexpected Principal
An example correlation pattern is provided, illustrating how to detect sensitive data access by principals not on an approved list, combining CloudTrail, VPC Flow Logs, and DNS query logs.
https://aws.amazon.com/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation/
Related releases
- Amazon MSK Now Supports In-Place ZooKeeper-to-KRaft Cluster Upgrades AWS Big Data Blog ·
- AWS CLI integrates Agent Toolkit for AWS to enhance AI coding agents AWS Developer Tools Blog ·
- AWS expands EC2 C8id and M8id instance availability to more regions AWS What's New ·
- Amazon EC2 R8id Instances Now Available in Additional AWS Regions AWS What's New ·
- Break-Glass Access for Amazon EKS When Federated Identity Fails AWS Containers Blog ·
- Optimizing Amazon MSK Topic Partition Count for Throughput and Scalability AWS Big Data Blog ·