BuildNot yet confirmed elsewhere1 publisher3 min readPublished
AWS detection gets a shortlist: seven ATT&CK tactics, and only what has been seen in the wild
A Yamato Security engineer maps CloudTrail events to seven ATT&CK tactics and drops techniques nobody has observed. The pruning is the useful part, and it will date fast.
The Engineer · Build desk
What happened
- A Yamato Security engineer has published a mapping of AWS events recorded in CloudTrail to the stages of MITRE ATT&CK, drawn from his HITCON 2026 talk on Suzaku and Senrigan.
- The mapping keeps seven of ATT&CK Enterprise's 14 tactics as the ones that matter when running an AWS environment.
- Credential-use activity is filed under T1078.004 rather than the T1087 placement SigmaHQ uses, a difference the author calls interpretation and does not dispute.
- The author warns that individual CloudTrail events look normal on their own and require correlation before any conclusion.
Why it matters
- decision Triage ordering stops being a matter of taste: a queue sorted by tactic gives a defensible reason to hold a Discovery hit and wake someone for Defense Evasion.
- constraint A shortlist built only from observed activity inherits the reporting gaps of the vendors it was built from, so anything not yet published sits outside the detection set by design.
- contradiction Two teams can cover identical API activity and report different tactic coverage, which makes per-tactic detection metrics non-comparable between shops that import Sigma rules and shops that follow...
- capability Because the tactic is the first token in a GuardDuty finding name, an ATT&CK-shaped rule set can be joined to GuardDuty output without maintaining a translation table.
Pruning is the load-bearing decision in this document, and it is also the one that takes on debt. Nishikawa says he left out events that are theoretically possible but have not been observed in the wild [6], and that the list comes from his own experience plus published research from Unit 42, Datadog Security Labs, Permiso, CrowdStrike and Rapid7 [5]. The coverage boundary of the shortlist is therefore the publication boundary of five vendors' write-ups. That is a far better boundary than "every API CloudTrail can emit", and it is a worse one than it looks on the day a technique gets used and not written up.
There is a tension inside the same article worth pulling on. He calls `GetCallerIdentity` the strongest indicator for this phase, alongside `iam:GetUser` and `iam:ListAccountAliases` [13], citing Unit 42's JavaGhost research, which found many threat actors make it their first API call after compromising AWS credentials in order to learn the account ID and user ID [18]. Elsewhere he writes that isolated events often look completely normal, and that you need a tool such as Suzaku, or correlation across several events, before concluding anything [14]. Both hold at once: high prior of attacker use, high base rate of benign use. Operationally that makes `GetCallerIdentity` a sequence opener rather than an alert. Fire a single-event rule on it and you have rebuilt the alert volume the article opens by complaining about [16].
The taxonomy argument matters more than taxonomy arguments usually do. T1078.004 spans four tactics, Initial Access, Persistence, Privilege Escalation and Defense Evasion [12]; he assigns it to Initial Access on the strength of that observed first call [17]. SigmaHQ places the same activity under T1087, which he declines to call wrong, distinguishing T1078 as the moment stolen credentials are used from T1087 as enumeration of account information [19][20]. Since GuardDuty finding names lead with the tactic string [8], and since he ranks urgency by tactic, with one Defense Evasion event outranking one Discovery event because it implies the attacker is already deep in [9], the bucket a rule lands in is what decides whether anyone gets paged.
The number nobody printed: half the Enterprise matrix is set aside, seven tactics of fourteen [1][7]. The stated reason for preferring ATT&CK to the Kill Chain is the same logic, since Weaponization cannot be observed inside a cloud environment at all [10]. And AWS entry is usually credential-shaped rather than mail-shaped, keys committed to GitHub by accident or lifted through SSRF [11], which is why the first tactic in this mapping begins at credential use rather than delivery. The framework here is being selected for what a log can actually show, and the honest caveat attached is that finding this before the incident remains much harder than reconstructing it afterwards [15].
What to watch
- Whether the remaining tactics in the series keep the same in-the-wild filter, and whether the list is re-dated as Unit 42, Datadog, Permiso, CrowdStrike and Rapid7 publish new tradecraft.
- Whether Suzaku ships correlation rules keyed to the seven tactics, so GetCallerIdentity is consumed as a sequence step rather than a standalone alert.
- Whether SigmaHQ or the author moves on the T1078 versus T1087 placement, which decides where imported rules land in a tactic-sorted queue.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap−10
- Incentives55
- Confidence52
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
MITRE ATT&CK Enterprise contains 14 tactics in total, but the author identifies seven as particularly important when operating an AWS environment.
- [2]
Akira Nishikawa, a security engineer and one of the developers behind the open-source tools Suzaku and Senrigan, presented on threat detection in AWS using those tools at HITCON 2026 as a member of the Yamato Security community.
- [3]
Yamato Security is a Japan-based, volunteer-run security community; 'Yamato' is an ancient name for Japan.
- [4]
The article summarises the events that occur in an AWS environment and are recorded in AWS CloudTrail at each stage of the MITRE ATT&CK Enterprise tactics covered in the presentation.
- [5]
The mapping is based on the author's own experience along with research and blog posts published by Unit 42, Datadog Security Labs, Permiso, CrowdStrike and Rapid7.
- [6]
The author states he intentionally omitted events that are theoretically possible but have not been observed in the wild, and asks readers to keep that limitation in mind.
- [7]
The seven tactics the author keeps are half of the 14 in the Enterprise matrix, meaning seven are set aside as not useful for AWS operations.
- [8]
Amazon GuardDuty finding names follow a convention in which the ATT&CK tactic appears at the beginning, for example Persistence:IAMUser/AnomalousBehavior, so detections organised around ATT&CK map directly onto findings.
- [9]
The author says urgency differs completely between one Discovery event and one Defense Evasion event, because the latter strongly suggests the attacker may already have penetrated deeply into the environment and should receive higher response priority.
- [10]
The author distinguishes the seven-phase grouping from the Cyber Kill Chain, noting the Kill Chain includes phases such as Weaponization that cannot be observed inside a cloud environment, and says he chose ATT&CK as more practical for designing AWS logging and detection.
- [11]
In AWS, major entry points are usually not malware-bearing emails; more commonly attackers use access keys accidentally committed to GitHub, or access keys stolen by exploiting vulnerabilities such as SSRF.
- [12]
The stolen-credential entry point corresponds to ATT&CK T1078.004 (Valid Accounts: Cloud Accounts), a technique that spans four tactics: Initial Access, Persistence, Privilege Escalation and Defense Evasion.
- [13]
Other APIs used during this phase include iam:GetUser and iam:ListAccountAliases, but the author says GetCallerIdentity is the strongest indicator in this context.
- [14]
The author says it is difficult to detect an attack by looking at isolated events, which viewed individually often look completely normal, and that you need a tool such as Suzaku or must correlate multiple events before drawing a conclusion.
- [15]
The author says investigations are often easier after an incident has occurred, and that proactively discovering threats before an incident is much more difficult.
- [16]
The article opens with three stated operator problems: collecting CloudTrail logs and enabling GuardDuty without knowing what to look for; alerts arriving without being able to tell attack from false positive; and wanting to write detection rules without knowing what attackers are likely to do.
- [17]
The author classifies T1078.004 under Initial Access because, based on what he has observed, attackers commonly begin by calling GetCallerIdentity.
- [18]
In its JavaGhost article, Unit 42 notes that many threat actors use GetCallerIdentity as their first API call after compromising AWS credentials, in order to identify the account ID and user ID.
ReportedContestedSource: Unit 42, cited by the author3 sources— create a free account to open themView cited source - [19]
Some organisations classify the same activity as Discovery under T1087.004, and SigmaHQ positions it under T1087; the author says he does not claim that classification is wrong.
- [20]
The author frames the disagreement as interpretation: T1078 describes the moment stolen credentials are used, while T1087 treats the activity as enumeration of account information, and he considers T1078 the better fit for AWS.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toAWS Security Events Through the Lens of the Seven MITRE ATT&CK Tactics
1 article · August 24, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- Akira NishikawaFollow
- Yamato SecurityFollow
- SuzakuFollow
- SenriganFollow
- MITRE ATT&CKFollow
- AWS CloudTrailFollow
- Amazon GuardDutyFollow
- T1078.004 Valid Accounts: Cloud AccountsFollow
- T1087.004 Account Discovery: Cloud AccountFollow
- SigmaHQFollow
- Unit 42Follow
- Datadog Security LabsFollow
- PermisoFollow
- CrowdStrikeFollow
- Rapid7Follow
- JavaGhostFollow
- TeamTNTFollow
- HITCONFollow
- Cyber Kill ChainFollow