To detect multi-stage attacks on AWS, correlate signals across services such as GuardDuty findings, CloudTrail API calls, and VPC Flow Logs by establishing baselines for normal behavior and looking for sequences like unusual GetCallerIdentity calls followed by internal port scans within minutes.
Establish baselines for normal identity and network behavior
Start by defining what normal looks like for each identity in your AWS environment. Use CloudTrail to track frequent API calls like GetCallerIdentity, DescribeInstances, or ListBuckets, noting the usual source IP addresses, geographic locations, and times of day. Establish these patterns over a 14- to 30-day window to build a reliable baseline.
For network behavior, analyze VPC Flow Logs to understand typical traffic flows between subnets, expected port usage, and common communication paths. Identify which instances usually talk to each other and on which protocols, filtering out noise from monitoring agents or automated scaling events.
Store these baselines in a centralized location such as Amazon S3 or a security data lake, and update them weekly. Use Amazon Athena or Amazon OpenSearch Service to query deviations efficiently when investigating alerts.
Correlate GuardDuty findings with CloudTrail and VPC Flow Logs
When GuardDuty flags an anomaly such as 'Recon:EC2/Portscan' or 'UnauthAccess:IAMUser/ConsoleLoginSuccess.B', immediately query CloudTrail for related API activity from the same principal and source IP within a 15- to 30-minute window. Look for preceding calls like GetCallerIdentity or STS AssumeRole that may indicate reconnaissance.
Next, examine VPC Flow Logs from the implicated EC2 instance or network interface for signs of lateral movement, such as sudden outbound connections to uncommon internal ports (e.g., RDP on 3389, SMB on 445) or scans across multiple internal IPs. Focus on traffic that deviates from established baselines.
Use Amazon EventBridge to automate this correlation: trigger a Lambda function on GuardDuty findings that queries CloudTrail and VPC Flow Logs, then enriches the finding with contextual data before sending it to a ticketing system or SIEM for analyst review.
Build and tune detection rules for attack sequences
Create detection logic that looks for specific sequences rather than isolated events. For example, flag when a user makes a GetCallerIdentity call from a new IP address, followed within 10 minutes by an attempt to disable CloudTrail logging (StopLogging) or modify a security group (AuthorizeSecurityGroupIngress).
Use Amazon Detective or custom rules in Amazon Security Lake to visualize these chains of events across time and service boundaries. Assign risk scores based on the rarity of each step and the sensitivity of the resources involved.
Regularly test your detection rules using red team exercises or penetration test simulations in isolated accounts. Measure mean time to detect (MTTD) and adjust thresholds or add new signal sources like DNS logs or Lambda execution traces as needed to reduce false negatives.
What to do next
Begin by enabling GuardDuty, CloudTrail, and VPC Flow Logs in all accounts and centralizing logs to a secure S3 bucket. Start with one high-risk identity or workload, establish its baseline, and build a simple correlation rule for a known attack pattern like credential access followed by discovery. Review results weekly and expand gradually.
FAQ
Do I need to enable all AWS security services to correlate signals effectively?
No, start with GuardDuty, CloudTrail, and VPC Flow Logs as they provide broad coverage for identity, API, and network signals. Add others like DNS logs or Lambda insights later based on your environment’s risk profile.
How often should I update baselines for normal behavior?
Update baselines every 7 to 14 days for fast-changing workloads, or monthly for stable environments. Use automated retraining in Amazon Lookout for Metrics or custom Lambda functions to keep them current without manual effort.
Source: Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation (AWS).
