Native Cloud
Detection Reference
Comprehensive detection reference for GuardDuty, Microsoft Defender for Cloud, and GCP Security Command Center. Covers finding types, MITRE ATT&CK mapping, IOCs, KQL/SPL queries, and response playbooks — all in one searchable reference.
Amazon GuardDuty analyses CloudTrail management events, S3 data events, VPC Flow Logs, DNS logs, EKS audit logs, and Lambda Network Activity to produce threat findings. Findings use the format ThreatPurpose:ResourceTypeAffected/ThreatFamilyName.Description
An IAM user is making API calls from an IP address on a custom threat intel list. Indicates credential theft and misuse from known attacker infrastructure.
userType: IAMUser
errorCode: none (successful call)
An IAM entity is attempting or has successfully escalated to administrative permissions — typically via iam:PassRole + lambda/EC2 creation, or modifying policies.
targetResource: AdministratorAccess policy ARN
An EC2 instance is querying domain names associated with cryptocurrency mining pools. Indicates a compromised instance being used for cryptojacking.
instanceId: affected EC2 ID
protocol: DNS
EC2 instance DNS traffic shows characteristics of DNS tunneling — encoding data in DNS queries to exfiltrate it through DNS protocol to external resolver.
query rate: >100/min from single instance
An IAM user is actively enumerating their own permissions — typical pre-escalation recon. Calls to iam:SimulatePrincipalPolicy, iam:GetPolicy, iam:ListAttachedUserPolicies.
CloudTrail logging was disabled. This is almost always attacker activity — disabling audit trail before executing primary attack objectives.
time gap: period without CloudTrail logs = blind spot
External IP is making repeated SSH login attempts against an EC2 instance. Indicates automated brute-force or credential stuffing attack targeting port 22.
destPort: 22
action: REJECT (SG blocking)
An S3 bucket was made publicly accessible via bucket policy or ACL change. Immediate data exposure risk — especially if bucket contains sensitive data.
principal: "*" or AllUsers
🔍 GuardDuty Finding Lookup Tool
Select the MITRE ATT&CK tactic or affected resource to see relevant GuardDuty findings, detection signals, and recommended response actions.
Microsoft Defender for Cloud provides CSPM + CWPP across Azure, AWS, and GCP. Integrates with Microsoft Sentinel for SIEM/SOAR. Defender for Cloud generates Security Alerts and Security Recommendations with MITRE ATT&CK mapping.
Unusual sign-in pattern detected — impossible travel, sign-in from Tor exit node, or leaked credential usage detected by Entra ID Protection.
location: multiple countries in <2h
VM process tree shows mining tools (xmrig, minergate), suspicious CPU usage, or outbound connections to known mining pools.
network: pool.minexmr.com:3333
A privileged Entra ID role (Global Admin, Security Admin) was assigned via direct assignment bypassing PIM JIT approval workflow. Possible insider threat or account compromise.
role: Global Administrator
User account is performing bulk file downloads from SharePoint/OneDrive — indicator of data exfiltration, insider threat, or compromised account collecting data before exiting org.
operation: FileDownloaded / FileSyncDownloadedFull
AKS pod running with privileged security context, hostNetwork, or cluster-admin role binding to service account — path to node/cluster escape.
roleBinding: cluster-admin → service account
Secret or key retrieval from Azure Key Vault from a new IP, Tor exit node, or IP outside expected application subnets. Could indicate compromised application or developer credentials.
caller IP: outside known VNet ranges
GCP Security Command Center (SCC) aggregates findings from Event Threat Detection, Container Threat Detection, VM Manager, Web Security Scanner, and partner integrations. SCC Premium includes real-time threat detection via Event Threat Detection.
Large data export from BigQuery to external GCS bucket or external project. ETD detects anomalously large query results or exports to unexpected destinations.
source: Event Threat Detection
indicator: bigquery.tables.export to gs://external-project
New IAM binding was added to a project, folder, or org with a sensitive role — especially Owner, Editor, or Security Admin. Unusual admin creating bindings for external accounts.
role: roles/owner or roles/editor
principal: external / new service account
ETD detects Log4Shell JNDI lookup patterns in VPC flow logs or DNS activity. Indicator of active exploitation attempt or successful RCE on a GCE instance or GKE pod.
detection: ETD Log4j Bad Domain rule
A service account is making IAM list/get calls to enumerate its own permissions or other project IAM policies — pre-escalation reconnaissance activity.
caller: service account (not human)
GCE instance is sending DNS queries to domains on Google Safe Browsing threat intelligence lists — malware C2, phishing, or malware distribution infrastructure.
indicator: DNS query to threat intel matched domain
GCE metadata server token was accessed from outside the instance — possible SSRF exploitation or insider token theft. Token provides SA-level GCP API access.
source IP: not matching instance private IP
| MITRE Tactic | AWS GuardDuty | Defender for Cloud | GCP SCC / ETD |
|---|---|---|---|
| TA0001 Initial Access | Good (SSH, EC2 port scan, TOR) | Good (Entra ID risk, AAD) | Partial (ETD for JNDI/Log4j) |
| TA0002 Execution | Partial (Lambda, ECS suspicious activity) | Good (VM run command, suspicious process) | Partial (Container Threat Detection) |
| TA0003 Persistence | Good (IAM backdoors, unusual login profiles) | Good (new user, PIM bypass) | Good (IAM anomalous grant) |
| TA0004 Privilege Escalation | Good (IAM policy changes, admin perms) | Good (PIM bypass, elevated role) | Partial (SA anomalies) |
| TA0005 Defense Evasion | Good (CloudTrail disable, Config changes) | Partial (Diagnostic setting disable) | Partial (Audit log disable) |
| TA0006 Credential Access | Good (anomalous key usage, IMDS) | Good (Key Vault, leaked creds) | Good (metadata server abuse) |
| TA0007 Discovery | Good (IAM enum, S3 recon) | Partial (subscription enum) | Good (SA self-investigation) |
| TA0010 Exfiltration | Good (S3 public, DNS tunnel, VPC flow) | Good (SharePoint mass download) | Good (BigQuery export, GCS) |
| TA0040 Impact | Good (crypto mining, ransomware) | Good (crypto, deletion alerts) | Partial (crypto mining) |
Good coverage · Partial — supplement with additional logging · Limited — requires SIEM enrichment