.svg)
Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring
Amazon GuardDuty Updates
Amazon GuardDuty now supports optional detection rules for Runtime Monitoring. You can enable more than 50 Runtime Monitoring rules that help detect process, file, and network activity that might be routine in one environment but a sign of compromise in another.
- New Rules: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, Exfiltration:Runtime/SuspiciousCommand
- Supported Services: Amazon EC2 instances, Amazon EKS, and Amazon ECS on both EC2 and AWS Fargate
- Finding Types: Mapped to MITRE ATT&CK® tactics including persistence, privilege escalation, execution, defense evasion, discovery, exfiltration, and command and control
What to do
- Visit the GuardDuty console to enable rules
- Evaluate detection efficacy in dry-run mode before enabling live detection
- Subscribe to the Amazon GuardDuty SNS topic for programmatic updates
Source: AWS release notes
If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.
