The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

On May 20, 2026, Amazon GuardDuty Extended Threat Detection enhanced its attack sequence correlation capabilities by integrating five new indicator types: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. These indicators leverage data from AWS Security Hub, Amazon Inspector, Amazon VPC Reachability Analyzer, and Amazon Macie to transform previously weak security signals into high-confidence CRITICAL findings. The enhancement addresses customer feedback about noisy runtime findings by correlating multiple weak signals with resource-state context, particularly benefiting Amazon EC2, ECS, and EKS workload monitoring. Initial deployment data showed a substantial increase in actionable attack sequence findings, with roughly one in four runtime-process sequences now surfacing as correlated CRITICAL alerts instead of disconnected low-priority findings. This advancement represents a significant evolution in AWS native threat detection, moving from isolated security events to comprehensive attack narrative reconstruction that provides security teams with immediate remediation context and prioritized response guidance.

Why This Matters Now

Multi-vector attacks are increasingly sophisticated, requiring correlation across multiple security signals to detect. Traditional isolated security findings create alert fatigue, while this enhanced correlation approach represents the future of cloud-native threat detection.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The new indicators are VULNERABILITY (CVE data with EPSS scores), MALICIOUS_PACKAGE (malware packages), REACHABILITY (internet accessibility), MISCONFIGURATION (security misconfigurations), and SENSITIVE_DATA (data classification findings).

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have likely constrained this multi-stage attack by implementing workload segmentation and controlled network paths across EKS clusters and EC2 instances. The attacker's lateral movement capabilities and blast radius would have been significantly reduced through identity-aware routing and east-west traffic controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Segmented network architecture would likely have limited the scope of initial exploitation by constraining reachability between vulnerable services and sensitive workloads across the cloud environment.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware access controls would likely have constrained the attacker's ability to assume elevated IAM roles by limiting cross-service privilege escalation paths between compromised and target resources.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely have blocked unauthorized communication paths between worker nodes and containers, limiting the attacker's ability to pivot freely across the EKS cluster infrastructure.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized visibility and control mechanisms would likely have detected and constrained suspicious outbound connections to external command and control infrastructure across multiple AWS service boundaries.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely have blocked or limited outbound communications to cryptocurrency mining pools and suspicious external destinations, constraining the attacker's resource exfiltration capabilities significantly.

Impact (Mitigations)

Residual impact would likely have been constrained to isolated network segments, limiting the scope of persistent access and reducing potential data exposure across the broader cloud infrastructure environment.

Impact at a Glance

Affected Business Functions

  • Cloud Infrastructure Security
  • Application Runtime Monitoring
  • Vulnerability Management
  • Threat Detection and Response
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Enhancement to AWS GuardDuty service capabilities providing improved threat detection through correlation of vulnerability indicators, malicious packages, reachability analysis, misconfigurations, and sensitive data discovery across EC2, ECS, and EKS environments

Recommended Actions

  • • Deploy Zero Trust Segmentation with microsegmentation policies to prevent lateral movement between EKS worker nodes and limit blast radius of compromised containers
  • • Implement Egress Security & Policy Enforcement with FQDN filtering to block cryptomining destinations and unauthorized outbound connections from clusters
  • • Enable Multicloud Visibility & Control with centralized policy enforcement to detect anomalous cross-service IAM role assumptions and repeated malformed requests
  • • Deploy East-West Traffic Security monitoring to detect and block frp reverse proxy tunnels and suspicious workload-to-workload communications
  • • Implement Threat Detection & Anomaly Response with baselining to identify covert tools like disguised kuboard-agent processes and establish incident response workflows

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image