What is intent-based detection?

Intent-based detection is an approach to cloud security that evaluates a sequence of actions to understand what a session is trying to accomplish, rather than matching individual API calls against a fixed list of known-bad patterns. It treats a session as a narrative rather than a stream of isolated events.

Why do signature-based rules fail in the cloud?

Signature-based rules work by matching specific patterns: if this exact API call appears, raise an alert. That model breaks down in cloud environments for a structural reason.

Every dangerous cloud API call is also a legitimate one. dynamodb:DeleteTable is how you clean up after integration tests. iam:DetachRolePolicy is standard role lifecycle management. ec2:StopInstances is how scheduled cost-saving automation works. There is no call you can block outright without hitting valid use cases. Any blocklist broad enough to catch real attacks will generate enough false positives to be turned off. Any list narrow enough to avoid false positives will miss most real incidents.

The problem is that the API name alone does not carry enough information. What matters is why it is being called.

What does reading the intent of a session mean?

It means treating the sequence of actions in a session as a story with a direction, not as a list of independent events.

Consider an engineer who opens an SSM session, lists S3 buckets, reads an object from the production secrets bucket, then immediately makes an outbound network request to an external IP. Each individual action has a plausible explanation. Together, they describe exfiltration. No single action would trigger a signature rule. The sequence makes the intent clear.

Intent-based detection captures that narrative. It asks: given what has happened so far in this session, what is the most likely goal? Does that goal match legitimate work in this environment? If the inferred goal is deleting infrastructure, disabling audit logging, or moving data outside the account, that warrants intervention regardless of whether any individual step is on a blocklist.

How does it differ from UEBA?

User and entity behavior analytics (UEBA) builds statistical baselines of normal behavior per user and flags deviations. Intent-based detection focuses on what a session is doing right now.

Both approaches are useful and they complement each other. UEBA excels at catching slow-moving anomalies: an account that gradually accumulates new permissions over weeks, or a user who starts accessing systems outside their usual scope. Intent-based detection excels at real-time intervention in active sessions, where speed matters. An attack sequence that unfolds over two minutes does not wait for a weekly anomaly report.

Another distinction: UEBA requires historical data to establish a baseline. Intent-based detection can evaluate a session from a new identity or a new service account on its first action, because it is reading the structure of the session rather than comparing to past behavior.

What does a multi-step attack look like at the command level?

Cloud incidents rarely involve a single obviously-bad action. They are built from steps that individually look unremarkable.

A common pattern: an identity lists IAM roles, then reads a policy document attached to a high-privilege role, then calls sts:AssumeRole to take on that role, then immediately begins calling CloudTrail stop-logging and S3 delete APIs. No single step in that chain is necessarily alarming. Listing roles is routine. Reading a policy is routine. AssumeRole happens thousands of times a day in any active AWS account. It is only when you see the full sequence, compressed into a short window, that the picture becomes clear.

Intent-based detection identifies that pattern before the last step executes, at the point where the sequence has enough shape to infer where it is going.

Korvalis applies intent-based detection to live cloud sessions, reading each action in context of the session so far and flagging sequences that match known attack patterns or imply goals that conflict with the environment’s policy.