Performing Cloud Native Threat Hunting With AWS Detective

Performing Cloud-Native Threat Hunting with AWS Detective

Overview

AWS Detective automatically collects and analyzes log data from AWS CloudTrail, VPC Flow Logs, GuardDuty findings, and EKS audit logs to build interactive behavior graphs. These graphs enable security analysts to investigate entities (IAM users, roles, IP addresses, EC2 instances) across time, identify anomalous API calls, detect lateral movement between accounts, and correlate GuardDuty findings into coherent attack narratives — all without manual log parsing.

Detection Gaps & Validation

• No retroactive visibility: Detective only analyzes data from when it (and GuardDuty, 48h+) was enabled, with a rolling ~1-year retention. Activity before enablement never appears - confirm the behavior graph's data range covers the incident before concluding nothing happened earlier.
• Per-account / per-region graphs: an attacker operating in a region or member account where Detective isn't enabled is invisible. Verify coverage with aws detective list-graphs in each region and confirm member accounts are enrolled under the admin account.
• Source coverage excludes S3 data events: Detective ingests CloudTrail management events, VPC Flow Logs, GuardDuty findings, and EKS audit logs - not S3 object-level data events. Pivot to S3 access logs / Athena to confirm or rule out data exfiltration.
• Scope Time hides slow attacks: the default 24h window misses low-and-slow campaigns. Widen Scope Time toward the 1-year max and re-profile the entity before clearing it.
• Indicators are heuristics, not verdicts: IMPOSSIBLE_TRAVEL, NEW_GEOLOCATION, NEW_ASO, and NEW_USER_AGENT produce false positives (VPNs, travel, new tooling). Validate each against raw CloudTrail (sourceIPAddress, userAgent, sessionContext) before escalating.
• No GuardDuty finding = nothing to correlate: Detective enriches GuardDuty; if the relevant detector or finding type is disabled, the campaign won't surface as a finding group. Confirm GuardDuty coverage for the IAM/EC2/EKS finding types in scope.
• How to confirm a hit: cross-reference the Detective entity timeline against raw CloudTrail for the same EntityArn/IP, and verify finding-group correlations match a manual log review before reporting.

Prerequisites

• AWS account with Detective enabled (requires GuardDuty active for 48+ hours)
• AWS CLI v2 configured with appropriate IAM permissions (detective:*, guardduty:List*)
• Python 3.9+ with boto3
• IAM policy: AmazonDetectiveFullAccess or custom policy with detective:SearchGraph, detective:GetInvestigation, detective:ListIndicators

Key Concepts

Steps

Step 1: List Available Behavior Graphs

aws detective list-graphs --output table

Step 2: Investigate a Suspicious IAM User

# Get entity profile for an IAM user
aws detective get-investigation \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \
  --investigation-id 000000000000000000001

Step 3: Search Entities Programmatically

#!/usr/bin/env python3
"""Search AWS Detective for suspicious entities."""
import boto3
import json
from datetime import datetime, timedelta

detective = boto3.client('detective')

def list_behavior_graphs():
    """List all Detective behavior graphs."""
    response = detective.list_graphs()
    return response.get('GraphList', [])

def get_investigation_indicators(graph_arn, investigation_id, max_results=50):
    """Get indicators for a specific investigation."""
    response = detective.list_indicators(
        GraphArn=graph_arn,
        InvestigationId=investigation_id,
        MaxResults=max_results
    )
    return response.get('Indicators', [])

def investigate_guardduty_findings(graph_arn):
    """List high-severity investigations correlated by Detective."""
    response = detective.list_investigations(
        GraphArn=graph_arn,
        FilterCriteria={
            'Severity': {'Value': 'CRITICAL'},
            'Status': {'Value': 'RUNNING'}
        },
        MaxResults=20
    )

    for investigation in response.get('InvestigationDetails', []):
        print(f"Investigation: {investigation['InvestigationId']}")
        print(f"  Entity: {investigation['EntityArn']}")
        print(f"  Status: {investigation['Status']}")
        print(f"  Severity: {investigation['Severity']}")
        print(f"  Created: {investigation['CreatedTime']}")
        print()

if __name__ == "__main__":
    graphs = list_behavior_graphs()
    for graph in graphs:
        print(f"Graph: {graph['Arn']}")
        investigate_guardduty_findings(graph['Arn'])

Step 4: Analyze Finding Groups for Attack Campaigns

# List investigations with high severity
aws detective list-investigations \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \
  --filter-criteria '{"Severity":{"Value":"HIGH"}}' \
  --max-results 10

Step 5: Check Entity Indicators

# Get indicators for a specific investigation
aws detective list-indicators \
  --graph-arn arn:aws:detective:us-east-1:123456789012:graph:a1b2c3d4 \
  --investigation-id 000000000000000000001 \
  --max-results 50

Expected Output

The list-investigations command returns investigation metadata:

{
  "InvestigationDetails": [
    {
      "InvestigationId": "000000000000000000001",
      "Severity": "CRITICAL",
      "Status": "RUNNING",
      "State": "ACTIVE",
      "EntityArn": "arn:aws:iam::123456789012:user/suspicious-user",
      "EntityType": "IAM_USER",
      "CreatedTime": "2026-03-15T14:30:00Z"
    }
  ]
}

Indicators are retrieved separately via list-indicators and include types such as TTP_OBSERVED, IMPOSSIBLE_TRAVEL, FLAGGED_IP_ADDRESS, NEW_GEOLOCATION, NEW_ASO, NEW_USER_AGENT, RELATED_FINDING, and RELATED_FINDING_GROUP.

Verification

1. Confirm behavior graph has data: aws detective list-graphs returns non-empty list
2. Validate investigation results contain entity timelines with API call sequences
3. Cross-reference Detective findings with raw CloudTrail logs for accuracy
4. Verify finding group correlations match manual investigation conclusions
5. Confirm automated alerts trigger for HIGH/CRITICAL severity investigations