AWS detection gets a shortlist: seven ATT&CK tactics, and only what has been seen in the wild

Pruning is the load-bearing decision in this document, and it is also the one that takes on debt. Nishikawa says he left out events that are theoretically possible but have not been observed in the wild ^[5], and that the list comes from his own experience plus published research from Unit 42, Datadog Security Labs, Permiso, CrowdStrike and Rapid7 ^[4]. The coverage boundary of the shortlist is therefore the publication boundary of five vendors' write-ups. That is a far better boundary than "every API CloudTrail can emit", and it is a worse one than it looks on the day a technique gets used and not written up.

There is a tension inside the same article worth pulling on. He calls `GetCallerIdentity` the strongest indicator for this phase, alongside `iam:GetUser` and `iam:ListAccountAliases` ^[17], citing Unit 42's JavaGhost research, which found many threat actors make it their first API call after compromising AWS credentials in order to learn the account ID and user ID ^[16]. Elsewhere he writes that isolated events often look completely normal, and that you need a tool such as Suzaku, or correlation across several events, before concluding anything ^[18]. Both hold at once: high prior of attacker use, high base rate of benign use. Operationally that makes `GetCallerIdentity` a sequence opener rather than an alert. Fire a single-event rule on it and you have rebuilt the alert volume the article opens by complaining about ^[20].

The taxonomy argument matters more than taxonomy arguments usually do. T1078.004 spans four tactics, Initial Access, Persistence, Privilege Escalation and Defense Evasion ^[12]; he assigns it to Initial Access on the strength of that observed first call ^[13]. SigmaHQ places the same activity under T1087, which he declines to call wrong, distinguishing T1078 as the moment stolen credentials are used from T1087 as enumeration of account information ^[14][15]. Since GuardDuty finding names lead with the tactic string ^[8], and since he ranks urgency by tactic, with one Defense Evasion event outranking one Discovery event because it implies the attacker is already deep in ^[9], the bucket a rule lands in is what decides whether anyone gets paged.

The number nobody printed: half the Enterprise matrix is set aside, seven tactics of fourteen ^[6][7]. The stated reason for preferring ATT&CK to the Kill Chain is the same logic, since Weaponization cannot be observed inside a cloud environment at all ^[10]. And AWS entry is usually credential-shaped rather than mail-shaped, keys committed to GitHub by accident or lifted through SSRF ^[11], which is why the first tactic in this mapping begins at credential use rather than delivery. The framework here is being selected for what a log can actually show, and the honest caveat attached is that finding this before the incident remains much harder than reconstructing it afterwards ^[19].