GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences

Amazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility. On May 20, 2026, the service started attaching five new indicator types to those sequences: MALICIOUS_PACKAGE , MISCONFIGURATION , REACHABILITY , SENSITIVE_DATA , and VULNERABILITY . For more information, see Document history for Amazon GuardDuty and Attack sequence finding details .