Akira Nishikawa, a security engineer from Yamato Security, presented at HITCON 2026 on AWS threat detection using Suzaku and Senrigan. This article summarizes AWS CloudTrail events aligned with MITRE ATT&CK Enterprise Tactics. The author emphasizes that detecting attacks relies on correlating multiple events, not isolated ones, and organizing detections by ATT&CK provides context for incident response. The MITRE ATT&CK framework, with its 14 tactics, is chosen for its practicality in AWS environments, particularly seven key tactics: Initial Access, Discovery, Credential Access, Persistence, Privilege Escalation, Defense Evasion, and Impact. Initial access often involves compromised access keys, with GetCallerIdentity being a common first call to identify account and user IDs. Discovery involves enumerating IAM permissions and resources, with suspicious patterns like rapid multi-region API calls or an increase in AccessDenied events indicating potential malicious activity. Credential access frequently targets AWS's Instance Metadata Service (IMDS), and prevention through IMDSv2 enforcement is recommended. Persistence techniques include creating new IAM users, abusing federation tokens, or leveraging Lambda functions with API Gateway. Tampering with trust policies and identity providers also serves as a persistence mechanism.