GuardDuty Now Zeroes In on Sensitive File Tampering!
Hey everyone, it's me, Shii-chan! Today I found an update that makes your security watch a little smarter.
AWS What's New
aws.amazon.com
What was announced?
Over on the AWS What's New feed, Amazon GuardDuty Runtime Monitoring just added three new threat detections that catch the moment a sensitive file gets modified. It watches the files you really don't want touched: configuration files, authentication settings, and system logs.
It covers EC2 instances and container workloads, and it's built to catch the quiet stick-around and clean-up moves attackers make after they get in.
The story so far
Runtime monitoring used to focus mostly on which commands were run. But clever attackers can obfuscate their commands and slip past command-line monitoring. Here's how GuardDuty puts it:
detect threats even when attackers use obfuscated techniques that bypass traditional command-line monitoring
So instead of judging by how a command looks, it looks at what actually happened to the file.
What changes
Even if the command is disguised, the file operation itself still leaves a trace, so watching that side means fewer misses. And thanks to correlation-based analysis, it can tell a legitimate admin action apart from a suspicious one, so you don't drown in alerts.
Dive Deep
There are five file operations it now watches: open-for-write, rename, symlink, link, and unlink, the basic moves of opening a file for writing, renaming it, and creating or removing links.
The results show up as three finding types:
Persistence:Runtime/SensitiveFileModifiedPrivilegeEscalation:Runtime/SensitiveFileModifiedDefenseEvasion:Runtime/SensitiveFileModified
Just reading the name tells you which stage of an attack you're looking at. You can learn how to read these in the Amazon GuardDuty Findings docs, and how to get notified via the Amazon GuardDuty SNS topic page.
It's available if you've enabled GuardDuty Runtime Monitoring for EC2, EKS, or ECS workloads, and new users get a 30-day free trial to ease into it.
Wrap-up
- GuardDuty Runtime Monitoring added three threat detections for sensitive file changes
- It watches five operations: open-for-write, rename, symlink, link, and unlink
- Findings come in three types (Persistence, PrivilegeEscalation, DefenseEvasion) so you can see the attack stage
- The trick is catching obfuscated-command attacks by watching file operations instead
- Aimed at teams running EC2, EKS, or ECS with Runtime Monitoring, with a 30-day free trial for newcomers
If you run EC2 or containers in production and want eyes on what happens after a breach, this one's for you!
