🔶 Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation

A guide to detecting multi-stage AWS attacks by correlating signals across CloudTrail, VPC Flow Logs, and Route 53 DNS logs. Covers four business-context-aware patterns: unexpected S3 access, abnormal role chains, KMS key misuse, and off-hours privileged changes, with CloudWatch Logs Insights queries and Lambda automation.

https://aws.amazon.com/ru/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation

#aws