AWS First Steps
LanguageEnglish
New feature

Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring

Amazon GuardDuty now supports optional detection rules for Runtime Monitoring, enabling over 50 rules to detect process, file, and network activity that may be routine in one environment but indicate compromise in another, such as modifying sudoers files or disabling audit logging.

Amazon GuardDuty now supports optional detection rules for runtime monitoring. Enabling over 50 rules detects non-standard processes, files, and network activities such as changes to sudoers files or audit log disabling. These rules run on Amazon EC2 instances, Amazon EKS, and Amazon ECS (on EC2 and AWS Fargate), covering 13 finding types mapped to MITRE ATT&CK tactics including persistence, privilege escalation, and defense evasion. This release introduces four new finding types: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, and Exfiltration:Runtime/SuspiciousCommand. To get started, enable rules in dry-run mode via the GuardDuty console before activating live detection. Custom detection rules are available in all AWS commercial regions and AWS GovCloud (US). For details, see Amazon GuardDuty custom detection rules. Subscribe to the Amazon GuardDuty SNS topic for programmatic updates on new features and threat detections.

Why it matters

Amazon GuardDuty automates security event monitoring and threat detection in cloud environments. This update adds customized detection rules for Runtime Monitoring, enabling security teams to more precisely identify threats.

Regions: All Regions

Read the original AWS announcement

Related articles and terms

Threat Detection with Amazon GuardDuty - ML-Based Anomaly Detection and Incident ResponseLearn how GuardDuty detects threats, classifies findings, and integrates with Security Hub for incident response.Amazon GuardDutyA managed threat detection service that uses machine learning and threat intelligence to continuously monitor and detect threats across AWS accounts and workloadsVulnerability Assessment and Threat Detection - Continuous Security Monitoring with Amazon Inspector and GuardDutyLearn how to design and operate vulnerability assessment and threat detection using Amazon Inspector and Amazon GuardDuty.Data Privacy Protection - Automated Sensitive Data Discovery and Threat Defense with Amazon Macie and GuardDutyLearn practical data privacy protection techniques combining Amazon Macie's automated sensitive data discovery in S3 with Amazon GuardDuty's threat intelligence. This article covers comprehensive security measures from identifying personal information to real-time threat detection.AWS Security Service Integration - Native Threat Detection from GuardDuty to Detective Without a SIEMWe explain the native threat detection mechanism through the integration of GuardDuty, Security Hub, Detective, and Macie, and compare the design philosophy differences with Azure Sentinel.