Spotting Anomalous Activity Patterns

The payoff of investigation is recognizing patterns that signal a compromise. Detective surfaces these, but you must know what they look like. This lesson covers the anomalous patterns that most often mean an attacker is at work in an AWS environment.

A sudden spike in API calls from an entity that is normally quiet is a classic red flag. Attackers enumerate resources and make many calls quickly. Detective's baseline comparison makes such spikes obvious against the entity's normal rhythm.

Activity from a country or IP never seen before for an entity often means stolen credentials. A role used only from your corporate Region suddenly acting from another continent is highly suspicious, especially combined with unusual actions.

Beyond volume, watch the kinds of actions. An identity that normally only reads data suddenly creating users, attaching policies, or deleting logs signals privilege abuse. New, sensitive actions are stronger evidence than mere call count.

Early attack stages show as reconnaissance: many describe and list calls, port probing, or failed access attempts as the attacker maps your environment. Spotting recon early, before the attacker acts, gives you the best chance to contain quickly.

An entity active from two distant locations within an impossibly short time, impossible travel, indicates the credential is being used by more than one party. This pattern is a near-certain sign that a secret has leaked and is being abused.

A high-confidence indicator is an actor turning off security: disabling GuardDuty, stopping CloudTrail, deleting logs, or changing config rules. Legitimate users rarely do this. Detective and GuardDuty both flag attempts to blind your defenses.

Large or unusual outbound data transfers, especially to unfamiliar destinations, suggest exfiltration. In the graph this appears as spikes in network volume or connections to new external IPs. Correlating this with a compromised entity confirms the theft.

One anomaly may be benign; several together rarely are. A new location plus a call spike plus log-disabling is a strong, correlated story of compromise. Detective's graph excels at letting you connect these signals into a confident conclusion.

A dangerous pattern is lateral movement: an attacker who compromises one resource using it to reach others, hopping between instances, roles, or even accounts. In the behavior graph this shows as a chain of new connections spreading outward from the first victim. Spotting lateral movement early is critical because it reveals the attack is expanding, not contained.

Not every anomaly is an attack. A new deployment, a relocated employee, or a fresh automation job can all look unusual at first. The discipline is to correlate signals and check context before acting: does the activity align with a known change, and do multiple indicators agree? Investigating rather than reacting prevents wasted effort and unnecessary disruption.

Identify a compromise pattern.

Anomalous patterns that signal compromise include API-call spikes, activity from new geolocations, unusual or sensitive API actions, reconnaissance, impossible travel, attempts to disable security controls, and data-exfiltration spikes. A single anomaly may be benign, but correlating several together gives a confident conclusion that drives containment.