Amazon GuardDuty introduces optional threat detection rules for runtime monitoring

Amazon GuardDuty has expanded its capabilities by introducing optional detection rules specifically designed for Runtime Monitoring. Users now have the option to activate over 50 Runtime Monitoring rules. These rules are intended to identify process, file, and network activities that may be typical in some environments but could indicate a security breach in others. Examples of such activities include modifications to sudoers files or the disabling of audit logging.

The newly implemented rules provide threat detection for Amazon EC2 instances, Amazon EKS, and Amazon ECS, applicable to both EC2 and AWS Fargate. They cover 13 types of findings aligned with MITRE ATT&CK® tactics, which include persistence, privilege escalation, execution, defense evasion, discovery, exfiltration, and command and control. This update also introduces four new types of findings: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, and Exfiltration:Runtime/SuspiciousCommand.

To begin using these features, users can access the GuardDuty console, where they have the option to enable rules in a dry-run mode. This mode allows for the evaluation of detection effectiveness prior to activating live detection.

The Custom Detection Rules for Runtime Monitoring feature is now available across all AWS commercial regions as well as the AWS GovCloud (US) Regions. For more detailed information, users are encouraged to consult the Amazon GuardDuty Custom Detection Rules documentation. Additionally, to stay informed about new Amazon GuardDuty features and threat detections, users can subscribe to the Amazon GuardDuty SNS topic for programmatic updates.