AWS GuardDuty Extended Threat Detection Adds Five New Indicators for Attack Sequences
Amazon GuardDuty now incorporates five new indicator types into its Extended Threat Detection findings to correlate weak signals into critical-severity attack sequences.
Key points
- Five new indicators were added to GuardDuty Extended Threat Detection on May 20, 2026.
- The service correlates weak signals from Inspector, Macie, and Security Hub into single findings.
- The new indicator types include MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
Amazon GuardDuty Extended Threat Detection began attaching five new indicator types to its attack sequence findings on May 20, 2026. According to an AWS Security Blog post, the service now correlates weak individual signals into single, critical-severity findings when their combined composition crosses a specific threshold of credibility.
The five new indicators are named MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. These indicators help the service prioritize high-priority signals within an account. This approach provides higher confidence findings on workload surfaces as part of an active defense strategy that monitors runtime activity on Amazon Elastic Compute Cloud, Amazon Elastic Container Service, and Amazon Elastic Kubernetes Service.
Context and Background
In GuardDuty, a signal represents any event the system evaluates for suspicious activity. A weak signal, on its own, does not clearly point to a threat. For example, a single Common Vulnerabilities and Exposures finding on a host indicates that a vulnerability exists, but it does not confirm that an attacker is actively exploiting it. These findings gain value only when GuardDuty correlates them with other suspicious-activity signals it already tracks.
The new indicators draw data from several other AWS services. Amazon Inspector provides data for the MALICIOUS_PACKAGE and VULNERABILITY indicators. Amazon Virtual Private Cloud Reachability Analyzer supports the REACHABILITY indicator. Amazon Macie contributes to the SENSITIVE_DATA indicator. AWS Security Hub powers the MISCONFIGURATION indicator based on AWS Foundational Security Best Practices. Teams running these services for other reasons now see their signals folded into attack sequence findings.
Who Is Affected
Organizations using GuardDuty Runtime Monitoring on Amazon EC2, Amazon ECS, and Amazon EKS are affected by this change. To populate the new indicators, specific prerequisite services must be enabled. Amazon Inspector must be active on Amazon EC2 and Amazon EKS to support vulnerability and malicious package detection. AWS Security Hub must be enabled to power misconfiguration findings. Amazon VPC Reachability Analyzer must be active on production VPCs to support reachability data.
The indicators appear on the Indicators tab of the attack-sequence finding in the AWS Management Console for GuardDuty. They are also available in the GetFindings JSON file. The VULNERABILITY indicator includes an Exploit Prediction Scoring System score, which estimates the probability that a published CVE will be exploited in the wild within the next 30 days. This score ranges from 0 to 1 and complements the Common Vulnerability Scoring System severity rating.
What should you do?
Security teams should verify that the prerequisite services are enabled in their environments. According to the AWS Security Blog, Amazon Inspector, AWS Security Hub, and Amazon VPC Reachability Analyzer must be active to populate the new indicators. Teams should also review their incident-response workflows to incorporate these new indicator types. The post serves as an operational guide for teams already running the prerequisite services, discussing how to fold these signals into their existing processes.
What to do and how to stay safe: Amazon GuardDuty
- Enable Amazon Inspector on Amazon EC2 and Amazon EKS to support vulnerability and malicious package indicators.
- Activate AWS Security Hub to power misconfiguration findings based on AWS Foundational Security Best Practices.
- Run Amazon VPC Reachability Analyzer on production VPCs to support reachability indicators.
- Ensure GuardDuty Runtime Monitoring is active on Amazon EC2, Amazon ECS, and Amazon EKS to provide anchor signals.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When did GuardDuty Extended Threat Detection add the new indicators?
The service started attaching the five new indicator types on May 20, 2026.
What are the five new indicator types added to GuardDuty?
The new indicators are MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
Which AWS services provide data for the new indicators?
Data comes from Amazon Inspector, Amazon VPC Reachability Analyzer, Amazon Macie, and AWS Security Hub.
