Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring

Amazon GuardDuty Updates

Amazon GuardDuty now supports optional detection rules for Runtime Monitoring, enabling more than 50 rules to detect process, file, and network activities that might indicate a security threat.

The new rules cover Amazon EC2 instances, Amazon EKS, and Amazon ECS on both EC2 and AWS Fargate, and include 13 finding types mapped to MITRE ATT&CK tactics. Four new finding types have been introduced: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, and Exfiltration:Runtime/SuspiciousCommand.

What to do

• Visit the GuardDuty console to enable rules in dry-run mode for evaluation.
• Enable live detection after evaluating detection efficacy.
• Subscribe to the Amazon GuardDuty SNS topic for programmatic updates.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.