Native Cloud Threat Detection Reference

☁ AWS GuardDuty — Finding Types & Response

Finding Type	What It Means	Severity	Immediate Response
UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B	Successful console login from an IP not associated with the account. Possible credential compromise.	High	Check if the user recognises the login. If not: rotate credentials, revoke sessions, check all actions in CloudTrail in last 24hr.
UnauthorizedAccess:EC2/MetaDataDNSRebind	DNS rebinding attack detected — attacker may be trying to access IMDS via browser.	High	Enforce IMDSv2. Check EC2 instance for web application SSRF vulnerabilities.
Recon:IAMUser/MaliciousIPCaller	API calls to IAM from a known malicious IP (GuardDuty threat intel).	Medium	Investigate which APIs were called. Rotate the access key. Check for new resources created.
Backdoor:EC2/C&CActivity.B	EC2 instance communicating with known C2 infrastructure.	High	Isolate instance immediately (quarantine security group). Snapshot for forensics. Begin IR.
CryptoCurrency:EC2/BitcoinTool.B	EC2 instance querying Bitcoin/Monero mining pools.	High	Terminate instance. Check for lateral movement. Review how instance was compromised.
Discovery:S3/MaliciousIPCaller	S3 bucket enumeration from malicious IP.	Medium	Check which buckets were accessed. Review bucket policies for public exposure. Rotate credentials used.
Exfiltration:S3/ObjectRead.Unusual	Unusual S3 GetObject calls — volume or pattern anomaly.	High	Check what data was accessed. Determine if access was authorised. Block source IP.
PrivilegeEscalation:IAMUser/AdministrativePermissions	IAM user granted administrative permissions to themselves.	High	Revoke admin permissions. Investigate who granted them. Check for new users or backdoors created.
Impact:EC2/WinRMBruteForce	Windows Remote Management brute force from EC2 instance.	Medium	EC2 instance may be compromised. Isolate and investigate.
Persistence:IAMUser/UserPermissions	New access key created for an existing user — possible persistence mechanism.	Medium	Verify if access key creation was authorised. Check if it was created for self or another user.
Policy:S3/BucketBlockPublicAccessDisabled	S3 Block Public Access was disabled on a bucket.	High	Re-enable Block Public Access. Check if any data was exposed during the period. Investigate who disabled it.
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS	EC2 instance credentials being used from another AWS account.	High	IMDS credentials exfiltrated. Immediately revoke instance role, attach new role, investigate SSRF on app.

Enable GuardDuty with optional protection plans

Plan	What It Adds	Cost Impact	Recommended?
GuardDuty (base)	CloudTrail, VPC Flow Logs, DNS logs analysis	Baseline	Essential — enable immediately
S3 Protection	S3 data event analysis — detect data exfiltration	+30-50%	Yes — especially if storing sensitive data
EKS Protection	Kubernetes audit log analysis	+20%	Yes if running EKS
Malware Protection	Scan EBS volumes of suspicious EC2 instances	Per scan	Yes for regulated environments
RDS Protection	Anomalous RDS login detection	Low	Yes if RDS holds sensitive data
Lambda Protection	Monitor Lambda network activity	Low	Yes if using Lambda extensively

🔷 Microsoft Defender for Cloud — Plans & Findings

Defender plans — enable by workload type

Plan	Covers	Key Detections	Cost (approx)
Defender for Servers P2	Windows & Linux VMs, Arc servers	Process injection, lateral movement, LOLBin abuse, fileless attacks, vulnerability assessment	$15/server/month
Defender for Storage	Azure Blob, Files, ADLS	Unusual access patterns, malware upload detection, ransomware pattern, crypto mining via blob	$0.02/10K transactions
Defender for SQL	Azure SQL, SQL Server on VMs	SQL injection attempts, unusual queries, brute force, data exfiltration queries	$15/server/month
Defender for Containers	AKS, ACR, Arc Kubernetes	Privileged container, host path mount, suspicious kubectl, cryptominer in container	$7/core/month
Defender for Key Vault	Azure Key Vault	Unusual access patterns, access from suspicious IPs, high-volume secret access, anonymous access	$0.02/10K transactions
Defender for APIs	Azure API Management	Unused/unauthenticated API endpoints, abnormal API patterns, API data exfiltration	$0/active API

Key Defender for Cloud alerts and response

Alert	Meaning	Response
Suspicious process executed	Process with known malicious hash or command pattern on VM — possible code execution	Isolate VM. Capture memory dump. Begin IR.
Behavior similar to ransomware	Mass file read/write/rename operations on a VM — ransomware pattern	Isolate immediately. Check Azure Backup integrity. Do NOT pay ransom before forensics.
Digital currency mining activity	Outbound connections to crypto pool addresses from VM	Terminate VM. Check how it was compromised. Review security group rules.
Unusual amount of resources created	Spike in resource creation — crypto mining or C2 infrastructure deployment	Review all resources created. Revoke credentials of creator. Check for new IAM assignments.
Suspicious Azure AD authentication	Sign-in from atypical location or device for this user	Verify with user. If unrecognised: revoke sessions, reset password, review MFA methods.
Anonymous access to Key Vault	Key Vault accessed without authentication — public access configured	Disable public access. Review what was accessed. Rotate any exposed secrets.
Kubernetes pod with host access	Pod created with hostNetwork, hostPID, or hostPath mount	Review who created the pod. Check for container escape. Enforce admission controller.

🟡 GCP Security Command Centre (SCC)

SCC tiers

Tier	What's Included	Cost
Standard (free)	Security Health Analytics (misconfigs), Web Security Scanner, anomaly detection	Free
Premium	Event Threat Detection, Container Threat Detection, VM Threat Detection, Rapid Vulnerability Detection, compliance reporting	Based on protected assets

SCC finding categories and response

Finding	Source	Meaning	Response
OPEN_FIREWALL	Security Health Analytics	Firewall rule allows ingress from 0.0.0.0/0	Remediate firewall rule. Use IAP for management access.
PUBLIC_BUCKET_ACL	Security Health Analytics	GCS bucket accessible to allUsers or allAuthenticatedUsers	Remove public access. Enable publicAccessPrevention org policy.
AUDIT_LOGGING_DISABLED	Security Health Analytics	Data Access audit logs not enabled for a service	Enable audit logging for the affected service.
SERVICE_ACCOUNT_KEY_CREATED	Event Threat Detection	Service account key created — potential credential exfiltration	Verify if key creation was authorised. Implement org policy to block SA key creation.
ACCOUNT_HAS_LEAKED_CREDENTIALS	Event Threat Detection	SA key found in a public location (GitHub, etc.)	Immediately delete the compromised key. Rotate any resources using it.
BITCOIN_MINING_ACTIVITY	Event Threat Detection	Network traffic to known crypto mining pools	Investigate the instance. Check for compromise. Terminate if confirmed.
ADDED_BINARY_EXECUTED	VM Threat Detection	Binary not part of original container image executed	Container may be compromised. Isolate and investigate.
MALICIOUS_SCRIPT_EXECUTED	VM Threat Detection	Known malicious script pattern detected on VM	Isolate VM. Forensic analysis. Check for lateral movement.
PRIVILEGED_CONTAINER	Container Threat Detection	Privileged container running in GKE cluster	Review who deployed it. Enforce PodSecurity policies. Remove if unauthorised.

🎛️ Tuning & Gap Coverage

Common false positives and how to suppress

Tool	Common FP	Suppression Method
GuardDuty	Penetration testing activity triggering UnauthorizedAccess findings	Create GuardDuty trusted IP list with pentest provider IPs. Or use GuardDuty suspension during pentest windows.
GuardDuty	Legitimate DevOps tools (Terraform, Ansible) triggering Recon findings	Add DevOps automation IAM roles to suppression rules via findings filter.
Defender	Security scanning tools triggering web attack alerts	Configure exclusion for scan tool IP ranges via Defender settings.
Defender	Legitimate admin operations triggering privilege escalation alerts	Use PIM activation reason to mark expected privilege changes.
SCC	Dev environment misconfigs triggering same findings as production	Use resource labels to separate dev/prod. Apply SCC mute rules to dev resources.

What none of them cover — additional tools needed