How AWS GuardDuty Integrates Five New Signals for Attack Sequences

Amazon GuardDuty Extended Threat Detection began incorporating five new indicator types on May 20, 2026, to enhance its ability to surface attack sequences. According to an AWS Security Blog post, the service now correlates weak individual signals into a single critical-severity finding when their combined composition crosses a specific threshold of credibility. This update aims to provide higher confidence findings for workload surfaces as part of an active defense strategy that monitors runtime activity on Amazon Elastic Compute Cloud, Amazon Elastic Container Service, and Amazon Elastic Kubernetes Service.

What are the new indicators and where do they come from?

The five new indicator types are MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. These indicators aggregate data from several other AWS services that organizations may already be running for separate purposes. Amazon Inspector provides the MALICIOUS_PACKAGE and VULNERABILITY indicators, while AWS Security Hub powers the MISCONFIGURATION indicator based on AWS Foundational Security Best Practices. Amazon VPC Reachability Analyzer supports the REACHABILITY indicator, and Amazon Macie contributes the SENSITIVE_DATA indicator. This integration allows Extended Threat Detection to fold these diverse signals into unified attack sequence findings.

How does GuardDuty handle weak signals and vulnerabilities?

A signal in GuardDuty is any event evaluated for suspicious activity, with weak signals being those that do not clearly point to a threat on their own. For example, a single Common Vulnerabilities and Exposures finding on a host indicates a vulnerability exists but does not prove an attacker is exploiting it. These findings gain value when GuardDuty correlates them with other suspicious-activity signals it already tracks.

The VULNERABILITY indicator includes Exploit Prediction Scoring System scores, which describe the probability that a published CVE will be exploited in the wild within the next 30 days. This metric is distinct from CVSS, which describes inherent severity, making EPSS more useful for incident response prioritization.

What prerequisites are required to see these indicators?

To populate these new indicators, specific AWS services must be enabled and configured within the account. Amazon Inspector must be active on Amazon EC2 and Amazon EKS to support the VULNERABILITY and MALICIOUS_PACKAGE indicators. AWS Security Hub powers the MISCONFIGURATION indicator, which identifies resources with configurations that do not align with AWS or industry best practices, such as IMDSv1 still being enabled or overly permissive admin policies.

Amazon VPC Reachability Analyzer must be enabled on production VPCs to support the REACHABILITY indicator. Additionally, GuardDuty Runtime Monitoring must be active on Amazon EC2, Amazon ECS, and Amazon EKS, as every signal it produces serves as a potential anchor for correlation.

What does this mean for incident response workflows?

The new indicators appear on the Indicators tab of the attack-sequence finding in the AWS Management Console for GuardDuty and are also included in the GetFindings JSON file. This operational guide is intended for teams already running the prerequisite services, helping them understand what the new indicators look like and how to fold them into their incident-response workflows.

By prioritizing the highest-priority signals in the account, Extended Threat Detection helps organizations focus on the most credible threats. Runtime signals such as process invocations or pod execs can sometimes be noisy, but correlating them with posture and vulnerability data helps distinguish active attacks from benign activity.

Background: Incident response plans

Create a documented plan that defines roles, communication channels, and containment steps before an attack. Test it with tabletop exercises to find gaps. Update it regularly to reflect new threats and team changes.

Read the full guide: Build an Incident Response Plan That Actually Works

What to do and how to stay safe: Amazon GuardDuty

• Verify that Amazon Inspector is enabled on your EC2 and EKS environments to capture vulnerability and malicious package data.
• Ensure AWS Security Hub is active and reviewing AWS Foundational Security Best Practices to generate misconfiguration indicators.
• Activate Amazon VPC Reachability Analyzer on production VPCs to provide reachability context for attack sequences.
• Monitor the Indicators tab in GuardDuty findings to correlate runtime signals with posture and vulnerability data.

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did GuardDuty start using these new indicators?

Amazon GuardDuty Extended Threat Detection started attaching the five new indicator types to attack sequences on May 20, 2026.

Do I need to buy new software to use these features?

No, but you must have Amazon Inspector, AWS Security Hub, Amazon VPC Reachability Analyzer, and GuardDuty Runtime Monitoring enabled.

What is the difference between CVSS and EPSS scores?

CVSS describes the inherent severity of a vulnerability, while EPSS describes the likelihood that the CVE will be exploited in the next 30 days.