---
title: "AWS Threat Detection: Services and Events to Watch - Cybr"
description: "The AWS-native services for threat detection, and the IAM and configuration changes that can signal a threat actor is in your account."
url: https://cybr.com/cloud-security/aws-threat-detection/
---

# AWS Threat Detection: Services and Events to Watch

The AWS-native services for threat detection, and the IAM and configuration changes that can signal a threat actor is in your account.

Christophe

Published February 7, 2024 · Updated October 27, 2026

Threat detection is about noticing when someone is doing something in your AWS environment that they shouldn't be. This post covers the AWS-native services built for it, and the IAM API calls that most often show up when a threat actor gets in.

## AWS-native threat detection services

- [Amazon GuardDuty](#amazon-guardduty) - AWS's threat detection service. It monitors your accounts and workloads for unusual and potentially malicious activity, using data from many different AWS services.
- [Amazon Detective](https://aws.amazon.com/detective/) - Investigate security findings visually, by following the relationships between the identities, resources, and activity involved.
- [AWS Security Hub](https://aws.amazon.com/security-hub/) - Correlates findings from GuardDuty, Amazon Inspector, Amazon Macie, and posture checks into prioritized risks.
- [AWS Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) - Checks your resources against security standards and best practices (cloud security posture management). This was the original Security Hub, renamed in 2025.

For the full list of AWS security services, see our [AWS Security Services cheat sheet](https://cybr.com/cloud-security/aws-security-services/).

## What events might indicate a threat actor has infiltrated your environment(s)?

A great way to understand what to look for with threat detection is to [study real-world incident reports](https://cybr.com/cloud-security/open-source-aws-security-tools/#case-studies), because they will often share Indicators of Compromise (IoCs).

While this is not a comprehensive list, below is a list of some commonly used API actions during incidents by threat actors. Of course, just because one of these actions is taken in your account doesn't automatically mean you've been breached. These actions can all be legitimately used as well, otherwise they wouldn't be part of the AWS API. The tricky part is identifying when they're legitimately used and when they're not.

## IAM configuration changes

| API Call | Explanation | Example of how this can be exploited |
| --- | --- | --- |
| `iam:ChangePassword` | Changes the password of the IAM user who is calling this operation |  |
| `iam:CreateUser` | Creates a new IAM user for your AWS account |  |
| `iam:CreateRole` | Creates a new role for your AWS account |  |
| `iam:CreateGroup` | Creates a new group |  |
| `iam:AddUserToGroup` | Adds a user to a group with potentially higher privileges | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamaddusertogroup) |
| `iam:AttachUserPolicy` | Attaches the specified managed policy to the specified user | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamattachuserpolicy) |
| `iam:AttachRolePolicy` | Attaches the specified managed policy to the specified IAM role | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamattachrolepolicy) |
| `iam:AttachGroupPolicy` | Attaches the specified managed policy to the specified IAM group | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamattachgrouppolicy) |
| `iam:PutUserPolicy` | Adds an inline policy for a specified user | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamputuserpolicy) |
| `iam:PutGroupPolicy` | Adds an inline policy for a specified IAM group | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamputgrouppolicy) |
| `iam:PutRolePolicy` | Adds an inline policy for a specified IAM role | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamputrolepolicy) |
| `iam:ListAccessKeys` | Returns information about the access key IDs associated with the specified IAM user |  |
| `iam:CreatePolicyVersion` | Creates a new version of the specified managed policy |  |
| `iam:SetDefaultPolicyVersion` | Sets an existing version of a managed policy as the default, such as an older, more permissive one | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamsetdefaultpolicyversion) |
| `iam:CreateLoginProfile` | Enables console login for a user with a password set by the threat actor. Only possible if the user doesn't already have a console login created | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamcreateloginprofile) |
| `iam:UpdateLoginProfile` | Changes the password for the specified IAM user to a password of the threat actor's choosing | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamupdateloginprofile) |
| `iam:CreateAccessKey` | Creates a new AWS secret access key and corresponding AWS access key ID for the specified user | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamcreateaccesskey) |
| `iam:UpdateAccessKey` | Changes the status of the specified access key from Active to Inactive, or vice versa. |  |
| `iam:DeactivateMFADevice` | Deactivates the specified MFA device and removes it from association with the username for which it was originally enabled | [Example](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamdeactivatemfadevice) |

For a longer list of CloudTrail events worth alerting on, beyond IAM, see [AWS CloudTrail events to monitor and alert on](https://cybr.com/cloud-security/aws-cloudtrail-events-to-monitor/).

## Amazon GuardDuty

GuardDuty is a managed threat detection service. Once you enable it, it continuously analyzes your AWS CloudTrail management events, VPC Flow Logs, and DNS query logs, without you having to turn those logs on or store them yourself, and it raises findings when it sees signs of compromise, like credentials being used from a known malicious IP address or an EC2 instance communicating with a cryptomining pool.

You can extend it with optional protection plans for specific workloads, including S3, EKS, RDS, Lambda, runtime monitoring for EC2 and containers, malware scanning for EC2, S3, and AWS Backup, and AI workloads. Extended Threat Detection, which is on by default at no extra cost, correlates related activity into a single attack sequence finding when it sees several stages of an attack.

To see what GuardDuty findings look like, explore them in our free [Amazon GuardDuty sandbox lab](https://cybr.com/hands-on-labs/lab/amazon-guardduty-sandbox/).

## Testing GuardDuty

The quickest way to see what findings look like is to generate sample findings from the GuardDuty console under **Settings** (or with the `CreateSampleFindings` API). They're clearly marked as samples and need no infrastructure.

To test detection for real, AWS's [Amazon GuardDuty Tester](https://github.com/awslabs/amazon-guardduty-tester) deploys a test environment with the AWS CDK and generates real findings across many finding types. Run it in a non-production account. For more ways to test your detections, see our list of [attack simulation tools](https://cybr.com/cloud-security/open-source-aws-security-tools/#attack-simulation).

## Sources and more info

- [AWS Compromised IAM Credentials Playbook](https://github.com/aws-samples/aws-customer-playbook-framework/blob/main/docs/Compromised_IAM_Credentials.md)
- [Amazon GuardDuty documentation](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html)

## Filed under

- [Cloud Security](https://cybr.com/cloud-security/)
- [Blue Team](https://cybr.com/blue-team/)
- [AWS](https://cybr.com/tag/aws/)
- [AWS Security](https://cybr.com/tag/aws-security/)
- [Threat Detection](https://cybr.com/tag/threat-detection/)
- [Cloud Security](https://cybr.com/tag/cloud-security/)

## Comments

Loading comments…

Recommended resources

[![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/)

## Build practical AWS security skills

Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice.

[Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)