On May 20, 2026, Amazon Web Services added five new indicator types to Amazon GuardDuty Extended Threat Detection to surface critical attack sequences. The update correlates weak signals from multiple AWS security services.
New Threat Indicators
According to Amazon Web Services, GuardDuty Extended Threat Detection began attaching five new indicator types on May 20, 2026. These indicators include MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
The service pulls these indicators from Amazon Inspector, Amazon Virtual Private Cloud Reachability Analyzer, Amazon Macie, and AWS Security Hub. By combining these signals with runtime events, GuardDuty aims to reduce noise and generate higher-confidence critical findings.
Prerequisites and Data Sources
To populate the new indicators, users must enable several prerequisite AWS services. Amazon Inspector supports vulnerabilities and malicious packages, while AWS Security Hub powers misconfiguration detections based on best practices.
Additional requirements include Amazon VPC Reachability Analyzer for production virtual private clouds, GuardDuty Runtime Monitoring for resource activity, and Amazon Macie for sensitive data discovery.
Incident Response Guidance
Amazon Web Services stated that security teams should treat sequences with malicious packages and high-priority vulnerabilities with urgency. Practitioners are advised to patch based on Exploit Prediction Scoring System-weighted priorities and isolate public resources flagged by reachability indicators.
What to do
- Treat attack sequences involving malicious packages and high-priority vulnerabilities with high urgency.
- Patch vulnerabilities based on EPSS-weighted priority rather than raw CVSS scores alone.
- Isolate public resources that are indicated by reachability indicators.
- Rotate every IAM credential, instance profile, or IAM Roles for Service Accounts bound role that could have been exposed.
Key facts and where they come from
- AWS added five new indicator types to GuardDuty Extended Threat Detection on May 20, 2026.
On May 20, 2026, the service started attaching five new indicator types to those sequences
- The five new indicators are MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
- The indicators originate from Amazon Inspector, Amazon VPC Reachability Analyzer, Amazon Macie, and AWS Security Hub.
These indicators come from Amazon Inspector, Amazon Virtual Private Cloud (Amazon VPC) Reachability Analyzer, Amazon Macie, and posture data surfaced through AWS Security Hub.