Spotting Suspicious Traffic in Flow Logs

Reading individual records is the foundation; the real value is spotting patterns across many records that betray malicious activity. Attackers leave network footprints, and Flow Logs are where those footprints appear. This lesson covers the signatures security teams hunt for in the data.

A port scan shows up as one source address hitting many destination ports on a host in a short window, usually with many REJECT actions. This pattern reveals reconnaissance, where an attacker maps which services are open. Counting distinct destination ports per source is a reliable way to surface it.

A network sweep is the inverse: one source contacting the same port across many destination IPs, looking for any host running a target service. Seeing one srcaddr touch a whole subnet on port 22 or 445 is a classic sign of an attacker probing for a foothold to exploit.

Exfiltration appears as unusually large outbound byte counts from an internal host to an external address, especially a new or foreign one. A web server that normally serves small responses suddenly uploading gigabytes is suspicious. Tracking top talkers by outbound bytes helps these stand out.

Cross-referencing destination addresses against threat-intelligence feeds of known malicious IPs flags communication with command-and-control servers. GuardDuty does this automatically, but you can replicate it in Athena queries by joining Flow Logs against an IP blocklist for custom detection.

Traffic on unusual ports or protocols for a workload's role is a warning. Outbound IRC, Tor, or cryptocurrency-mining pool ports from a server that should only serve HTTPS suggest compromise. Baselining what normal looks like for each tier makes these deviations obvious.

After breaching one host, attackers move sideways. Lateral movement shows as internal-to-internal connections that break normal patterns, such as an application server suddenly opening SSH or SMB sessions to many peers. East-west traffic that does not fit the architecture deserves scrutiny.

At scale you analyze Flow Logs in Athena over data in S3. SQL lets you group by source, count distinct ports, sum outbound bytes, and filter by action. A few well-crafted queries turn billions of records into a short list of the riskiest flows, far faster than manual review.

For speed, send Flow Logs to CloudWatch Logs and use metric filters and alarms on suspicious patterns, or stream via subscription filter to a Lambda detector. This converts after-the-fact hunting into near-real-time alerting, shrinking the attacker's window before someone responds.

Not every anomaly is an attack. Scanners from your own security tooling, health checks, and backups create benign patterns. Tuning detections with allow-lists for known sources and baselines for normal volume keeps alerts trustworthy, so the real signal is not lost in noise.

The strongest approach layers managed and custom detection: let GuardDuty flag known threats from Flow Logs automatically, use Athena for deep custom hunting, and keep CloudWatch alarms for your highest-priority patterns. Flow Logs are the shared evidence base that makes all three work.

Test your threat-hunting skills.

Hunt for patterns: port scans (one source, many ports, REJECTs), sweeps (one port, many hosts), exfiltration (large outbound bytes to new IPs), known-bad IP contact, and lateral movement (unusual east-west traffic). Use Athena for deep queries, CloudWatch alarms for real-time alerting, and GuardDuty for managed detection, tuning out benign noise.