Key points
- Five new indicator types were added to GuardDuty Extended Threat Detection on May 20, 2026.
- The service correlates weak signals into single, critical-severity attack sequence findings.
- Data sources include Amazon Inspector, VPC Reachability Analyzer, Macie, and Security Hub.
Amazon GuardDuty Extended Threat Detection now incorporates five new indicator types to help organizations identify complex attack sequences within their cloud infrastructure. According to the AWS Security Blog, the service began attaching these indicators on May 20, 2026. This update allows the platform to correlate previously weak signals into a single, critical-severity finding when the combination of events crosses a specific threshold of credibility.
The five new indicators are MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. These signals are drawn from Amazon Inspector, Amazon Virtual Private Cloud Reachability Analyzer, Amazon Macie, and AWS Security Hub posture data. By folding these diverse signals into attack sequence findings, GuardDuty helps security teams prioritize high-priority alerts across Amazon EC2, Amazon ECS, and Amazon EKS workloads.
What we know
GuardDuty defines a weak signal as an event that does not clearly indicate a threat on its own. For example, a single Common Vulnerabilities and Exposures finding on a host shows a vulnerability exists but does not prove exploitation. The new system gains value by correlating these static findings with suspicious activity signals already tracked by the service.
The VULNERABILITY indicator includes Exploit Prediction Scoring System scores, which estimate the probability of a published CVE being exploited in the wild within thirty days. According to the FIRST EPSS overview, this score ranges from zero to one and complements Common Vulnerability Scoring System severity ratings. Security teams can use EPSS to gauge immediate exploitation likelihood during incident response.
To populate these indicators, organizations must enable specific AWS services. Amazon Inspector must run on EC2 and EKS for vulnerability and malicious package data. AWS Security Hub powers misconfiguration findings based on foundational security best practices. Amazon VPC Reachability Analyzer must be active on production VPCs, and GuardDuty Runtime Monitoring must cover EC2, ECS, and EKS environments.
Defender's checklist
- Verify Amazon Inspector is enabled on EC2 and EKS instances to support vulnerability detection.
- Ensure AWS Security Hub is active to provide misconfiguration data for attack sequences.
- Activate Amazon VPC Reachability Analyzer on production networks to assess internet exposure.
- Confirm GuardDuty Runtime Monitoring is running on all eligible compute workloads.
What to do and how to stay safe: AWS
- Review your current GuardDuty configuration to ensure all prerequisite services are enabled and generating data.
- Update incident response playbooks to include the five new indicator types in your analysis workflow.
- Monitor the Indicators tab in the AWS Management Console for new attack sequence findings.
- Check GetFindings JSON files for structured data on these new signal types once the vendor provides an update.
Step-by-step guide: Account Takeover: Definition, Vectors, and Defense Strategies
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the five new indicator types added to GuardDuty?
The new indicators are MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
Which AWS services provide data for these new indicators?
Data comes from Amazon Inspector, Amazon VPC Reachability Analyzer, Amazon Macie, and AWS Security Hub.
When did GuardDuty start using these new indicators?
The service started attaching these indicators to attack sequences on May 20, 2026.
