AWS Adds Five Risk Indicators to GuardDuty Extended Threat Detection
Summary
AWS says GuardDuty Extended Threat Detection began adding five indicator types to attack-sequence findings on May 20, 2026, correlating runtime signals with vulnerability, package, reachability, misconfiguration, and sensitive-data context.
Key points
- The five new indicators—MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY—draw on Amazon Inspector, Security Hub, VPC Reachability Analyzer, and Macie.
- Populating the indicators requires the relevant AWS services to be enabled, including GuardDuty Runtime Monitoring and the corresponding Inspector, Security Hub, Reachability Analyzer, and Macie capabilities.
- AWS reports that, during the first week, net-new findings represented roughly one in four prioritized runtime-process attack sequences, with little change on the network-IOC surface.
- In an AWS-described EKS example, signals over eight days were correlated with package, vulnerability, internet-reachability, and IMDSv1 misconfiguration indicators into a CRITICAL attack-sequence finding.
- AWS says Linux/frp binaries, sometimes disguised as kuboard-agent binaries, were observed in the launch sample; it warns that rebuilding nodes from an unpatched AMI may not remove them.
- AWS recommends prioritizing remediation using EPSS, isolating internet-reachable resources, and rotating potentially exposed IAM credentials and roles.
Article Details
- Event Type
- Cloud security product capability update
- Impact
- On May 20, 2026, Amazon GuardDuty Extended Threat Detection began adding five indicator types—MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY—to attack-sequence findings. The indicators combine signals from AWS security services with runtime activity to provide higher-confidence, more actionable findings. AWS reports that during the first week, roughly one in four prioritized runtime-process attack sequences were net-new, with little change on the network-indicator surface.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 198[.]51[.]100[.]69 | Reported external source IP that authenticated as four distinct IAM identities to the same EKS cluster during the observed attack sequence. |
MITRE ATT&CK
CVE
CVE-2007-4559Observations added by the new indicators: VULNERABILITY listed CVE-2007-4559 Python tarfile with EPSS around 0.9 on two of the three involved instances.CVE-2022-1471On the cluster: 12 CVEs including CVE-2022-1471 (SnakeYAML deserialization, EPSS 0.94), CVE-2024-4577 (PHP-CGI argument injection, EPSS 0.97), CVE-2024-34351 (Next.js SSRF), CVE-2025-29927 (Next.js authenticationCVE-2022-37434SSRF), CVE-2025-29927 (Next.js authentication bypass), CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2022-37434 (zlib heap overflow, EPSS 0.92).CVE-2023-44487injection, EPSS 0.97), CVE-2024-34351 (Next.js SSRF), CVE-2025-29927 (Next.js authentication bypass), CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2022-37434 (zlib heap overflow, EPSS 0.92).CVE-2024-34351(SnakeYAML deserialization, EPSS 0.94), CVE-2024-4577 (PHP-CGI argument injection, EPSS 0.97), CVE-2024-34351 (Next.js SSRF), CVE-2025-29927 (Next.js authentication bypass), CVE-2023-44487 (HTTP/2 Rapid Reset),CVE-2024-4577On the cluster: 12 CVEs including CVE-2022-1471 (SnakeYAML deserialization, EPSS 0.94), CVE-2024-4577 (PHP-CGI argument injection, EPSS 0.97), CVE-2024-34351 (Next.js SSRF), CVE-2025-29927 (Next.js authenticationCVE-2025-29927EPSS 0.94), CVE-2024-4577 (PHP-CGI argument injection, EPSS 0.97), CVE-2024-34351 (Next.js SSRF), CVE-2025-29927 (Next.js authentication bypass), CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2022-37434 (zlib heap
Vendors
Products
Amazon ECSruntime activity on Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Container Service (Amazon ECS), and Amazon Elastic Kubernetes Service (Amazon EKS).Amazon Elastic Kubernetes Service(Amazon EC2), Amazon Elastic Container Service (Amazon ECS), and Amazon Elastic Kubernetes Service (Amazon EKS).Amazon GuardDuty Extended Threat DetectionAmazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility.Amazon InspectorThese indicators come from Amazon Inspector, Amazon Virtual Private Cloud (Amazon VPC) Reachability Analyzer, Amazon Macie, and posture data surfaced through AWS Security Hub.Amazon VPC Reachability AnalyzerAmazon VPC Reachability Analyzer on production VPCs to support REACHABILITY.AWS EC2as part of an active defense strategy monitoring runtime activity on Amazon Elastic Compute Cloud (Amazon EC2), Amazon Elastic Container Service (Amazon ECS), and Amazon Elastic Kubernetes Service (Amazon EKS).AWS Security HubThese indicators come from Amazon Inspector, Amazon Virtual Private Cloud (Amazon VPC) Reachability Analyzer, Amazon Macie, and posture data surfaced through AWS Security Hub.MacieThese indicators come from Amazon Inspector, Amazon Virtual Private Cloud (Amazon VPC) Reachability Analyzer, Amazon Macie, and posture data surfaced through AWS Security Hub.
Tools
Burp CollaboratorBurp Collaborator out-of-band callback hostnames were found under *[.]oastify[.]com, matching pattern <35-char base32>[.]oastify[.]com.Linux/frpHackTool family Linux/frp (Fast Reverse Proxy variants were used as command-and-control tunnels), often disguised as kuboard-agent and kuboard-agent-server binaries on Amazon EKS worker nodes.