Amazon GuardDuty adds threat detection rules for Runtime Monitoring
Amazon GuardDuty introduces over 50 optional detection rules for Runtime Monitoring to identify suspicious activity across EC2, EKS, and ECS.
Amazon GuardDuty has introduced optional detection rules for its Runtime Monitoring feature, allowing users to identify suspicious activity within their environments. This update helps security teams detect potential compromises by monitoring process, file, and network behavior across various AWS compute services.
What is new in Amazon GuardDuty Runtime Monitoring?
The service now supports more than 50 optional detection rules designed to identify activities that might appear routine in one environment but indicate a compromise in another. These rules monitor for specific behaviors, such as the modification of sudoers files or the disabling of audit logging.
- Supported Services: The rules apply to Amazon EC2 instances, Amazon EKS, and Amazon ECS (running on both EC2 and AWS Fargate).
- New Finding Types: Four specific finding types have been introduced:
- CommandAndControl:Runtime/SuspiciousCommand
- CredentialAccess:Runtime/SensitiveFileRead
- Discovery:Runtime/SensitiveFileRead
- Exfiltration:Runtime/SuspiciousCommand
- Dry-run Mode: Users can enable these rules in a dry-run mode to evaluate detection efficacy before enabling live monitoring.
Why does this update matter for security teams?
For developers and security professionals, these rules provide deeper visibility into the internal operations of compute resources. By mapping findings to the MITRE ATT&CK framework, GuardDuty helps teams understand the intent behind suspicious activities, such as privilege escalation or defense evasion.
For example, a builder can use the dry-run mode to test how these new rules would react to their specific workloads, ensuring the rules are effective without triggering live alerts or impacting operations.
How do the new GuardDuty detection rules work?
The optional rules span 13 finding types that are mapped to various MITRE ATT&CK tactics. These tactics include:
- Persistence
- Privilege escalation
- Execution
- Defense evasion
- Discovery
- Exfiltration
- Command and control
Where is Amazon GuardDuty Runtime Monitoring available?
Custom Detection Rules for Runtime Monitoring are available in all AWS commercial Regions and the AWS GovCloud (US) Regions.
Source: aws.amazon.com