Detección de amenazas en AWS: definición, riesgos y enfoques

AWS threat detection refers to identifying and prioritizing malicious or suspicious activity in AWS by analyzing cloud telemetry for signs of attacker behavior. Rather than evaluating single events in isolation, this approach examines what an actor is doing across identities, roles, and services. With 80% of organizations experiencing at least one cloud security breach in the past year and public cloud incidents averaging $5.17 million per breach, the stakes for effective AWS threat detection continue to grow.

AWS environments generate large volumes of logs and metadata that are difficult to interpret independently. Connecting this telemetry into behavioral signals helps reveal attacker movement through a cloud attack lifecycle, which matters because uncorrelated activity can delay investigation and response.

¿Qué significa en la práctica la detección de amenazas de AWS?

En la práctica, la detección de amenazas de AWS vincula las acciones relacionadas con patrones de comportamiento que pueden investigarse y priorizarse. En lugar de tratar cloud como una colección de alertas inconexas, interpreta la actividad como evidencia de una posible secuencia de ataques. Esta distinción es importante porque muchas acciones de AWS son técnicamente legítimas, pero siguen representando un abuso de acceso, funciones o servicios.

Activity types that reveal intent across time and services:

• Using compromised identities to gain initial access to AWS resources.
• Assuming roles and leverage temporary credentials to obscure the original actor.
• Chaining or "jumping" between roles to evade attribution across multiple accounts or services.
• Evading defenses by attempting to disable, suppress, or bypass logging.
• Exfiltrating data or performing destructive actions after expanding privileges.

AWS threat detection tools and services

AWS provides several native security services that form the foundation of a cloud threat detection strategy. Understanding what each tool does — and where gaps remain — helps teams build effective detection coverage.

Amazon GuardDuty

Amazon GuardDuty is the primary AWS threat detection service. It continuously analyzes CloudTrail management events, VPC Flow Logs, DNS query logs, and runtime telemetry using machine learning, anomaly detection, and integrated threat intelligence. In December 2025, AWS launched Extended Threat Detection for EC2 and ECS, which uses AI/ML to correlate signals across multiple data sources and map multi-stage attack sequences to MITRE ATT&CK tactics.

AWS Security Hub

Security Hub aggregates findings from GuardDuty, Amazon Inspector, AWS Config, and third-party tools into a unified dashboard. It provides compliance checks against standards like CIS AWS Foundations and supports automated remediation through integrations with AWS Lambda and Amazon EventBridge.

Amazon Detective

Detective complements GuardDuty by providing deeper investigative analysis. When GuardDuty identifies a high-severity finding, Detective helps trace the origin, scope, and relationships of the suspicious activity across resources.

Table: AWS native threat detection services compared

These native tools provide essential coverage, but they focus on activity within AWS. Attacks that start outside AWS — through compromised identity providers, on-premises networks, or SaaS applications — require additional correlation across hybrid environments to detect the full attack chain.

Por qué la supervisión de AWS centrada en los registros no detecta el comportamiento de los atacantes

Log-centric monitoring in AWS often fails to expose attacker behavior because events are analyzed as standalone records. Attribution frequently stops at the most recent role or temporary credential, causing investigations to focus on the wrong abstraction. As a result, defenders may not identify the original actor in time to contain activity before impact.

Failure modes when AWS activity is evaluated as isolated events:

• Event-by-event alerting that fails to connect actions across services or time
• Incomplete attribution that stops at an assumed role instead of tracing back to the original actor
• Siloed views across accounts, regions, and domains that prevent a unified narrative
• Manual correlation burden that delays response and increases cognitive load
• High alert volume that obscures which identity or account poses the highest risk

Los comportamientos de los atacantes que la detección de amenazas ayuda a revelar

Understanding how attackers move through AWS requires looking beyond individual service actions. Behavior-focused detection highlights progression patterns, such as role chaining, logging evasion, and lateral service access, that can appear legitimate when viewed in isolation.

Progression patterns:

• Infiltración mediante ingeniería social y abuso de relaciones de identidad de confianza.
• Uso de roles asumidos para abstraer la identidad y evadir la atribución directa.
• Encadenamiento de roles en varios pasos que oculta la identidad comprometida original.

Señales e indicadores utilizados en la detección de amenazas de AWS

No todas las señales en AWS tienen el mismo valor investigativo. Los esfuerzos de detección dan prioridad a los indicadores que reflejan un comportamiento anormal o de múltiples pasos vinculado a un actor específico. Los indicadores tempranos pueden ser sutiles y dispersos, mientras que las señales tardías a menudo solo aparecen después de que se ha producido un daño significativo.

Key signals:

• Desviaciones de la línea de base, como llamadas API inusuales o patrones de uso de credenciales.
• Early reconnaissance behaviors that suggest exploration of permissions or resources
• Cadenas de asunción de roles y secuencias de credenciales que indican actividad de encadenamiento de roles.
• Intentos de desactivar, reducir o eludir el registro y la cobertura de supervisión.
• Comportamiento correlacionado entre la identidad, la red y cloud que apunta a un único actor.
• Late-stage indicators such as command-and-control communication or data exfiltration

Real-world AWS threat detection incidents

Recent incidents illustrate why behavioral detection matters more than log-level monitoring alone.

Codefinger ransomware (January 2025)

The Codefinger ransomware group exploited compromised AWS credentials to encrypt S3 data using server-side encryption with customer-provided keys (SSE-C). Because the attackers used legitimate AWS encryption features rather than malware, traditional signature-based detection tools missed the activity. Only behavioral monitoring — detecting unusual bulk encryption operations tied to a suspicious credential chain — could surface the attack before data became unrecoverable.

AI-augmented FortiGate exploitation (January–February 2026)

Amazon Threat Intelligence documented a campaign in which a Russian-speaking financially motivated threat actor used commercial generative AI services to compromise over 600 FortiGate devices across 55+ countries between January 11 and February 18, 2026. The attackers leveraged AI to scale their operations, demonstrating that AI-augmented threats are accelerating attack volume for both skilled and unskilled adversaries.

LexisNexis ECS role abuse (February 2026)

In February 2026, a threat actor exploited an unpatched React frontend application running on AWS to gain initial access, then abused an over-permissive ECS task role with broad read access to AWS Secrets Manager. This enabled exfiltration of Redshift credentials, VPC maps, and millions of database records. The incident mapped to MITRE ATT&CK techniques including T1190 (exploit public-facing application), T1078 (valid accounts), and T1530 (data from cloud storage object) — underscoring why monitoring identity and role behavior is essential for AWS threat detection.

These incidents share a pattern: attackers used legitimate AWS mechanisms (encryption features, valid roles, temporary credentials) to carry out malicious activity that looked normal at the event level but revealed itself through behavioral analysis.

Limitaciones y conceptos erróneos sobre la detección de amenazas de AWS

La detección de amenazas en AWS aún tiene sus limitaciones. Si bien puede identificar comportamientos sospechosos, la detección de amenazas no previene ni remedia automáticamente los riesgos cloud . Esto significa que los equipos aún deben depender de los flujos de trabajo de respuesta y el criterio de los analistas. Confundir la detección con la prevención puede crear puntos ciegos que retrasen la contención.

Table: Misconceptions vs. corrections

The future of AWS threat detection

Several trends are reshaping how organizations approach threat detection in AWS environments.

• AI-augmented attacks are accelerating. As demonstrated by the 2026 FortiGate campaign, threat actors are using generative AI to scale exploitation. AWS threat detection must keep pace by correlating signals faster than attackers can generate them.
• Identity is the new perimeter. With over 70% of cloud breaches originating from compromised identities and 61% of organizations maintaining root users without MFA, identity-centric detection will continue to take priority over network-centric approaches.
• Multi-stage attack detection is becoming table stakes. GuardDuty's Extended Threat Detection represents a shift toward correlating actions across services and time rather than evaluating events individually. This pattern will expand to cover more AWS services and cross-cloud scenarios.
• Hybrid attack paths require unified visibility. As organizations operate across AWS, Azure, on-premises, and SaaS environments, threat detection strategies that treat each domain in isolation will miss the attacks that matter most — those that move laterally across boundaries.

Cómo la Vectra AI ayuda a detectar amenazas en AWS a través del comportamiento correlacionado de los atacantes

Supporting AWS threat detection requires understanding attacker behavior across identity, network, and cloud activity as a single continuum. The Vectra AI Platform approaches this problem by correlating actions instead of treating AWS events as isolated alerts, which reduces uncertainty when roles, temporary credentials, and multi-service activity obscure attribution. Vectra AI's Cloud Detection and Response (CDR) for AWS extends detection beyond native tools by analyzing behaviors across hybrid attack surfaces.

Platform capabilities:

• Observar el comportamiento correlacionado de los atacantes en todas las identidades, funciones y cloud , en lugar de eventos aislados de AWS.
• Decidir qué identidad o cuenta representa el mayor riesgo, haciendo hincapié en la urgencia y el contexto por encima del volumen.
• Reducir el riesgo de atribución errónea de encadenamiento de roles conectando la actividad sospechosa con el actor original siempre que sea posible.
• Detecting suspicious sequences of exploration activities that indicate early-stage reconnaissance before lateral movement begins

See AWS attacker behavior in action with a guided attack tour