# GuardDuty Now Zeroes In on Sensitive File Tampering!

Hey everyone, it's me, Shii-chan! Today I found an update that makes your security watch a little smarter.

## What was announced?

Over on the AWS What's New feed, Amazon GuardDuty Runtime Monitoring just added three new threat detections that catch the moment a sensitive file gets modified. It watches the files you really don't want touched: configuration files, authentication settings, and system logs.

It covers EC2 instances and container workloads, and it's built to catch the quiet stick-around and clean-up moves attackers make after they get in.

## The story so far

Runtime monitoring used to focus mostly on which commands were run. But clever attackers can obfuscate their commands and slip past command-line monitoring. Here's how GuardDuty puts it:

> detect threats even when attackers use obfuscated techniques that bypass traditional command-line monitoring

So instead of judging by how a command looks, it looks at what actually happened to the file.

## What changes

Even if the command is disguised, the file operation itself still leaves a trace, so watching that side means fewer misses. And thanks to correlation-based analysis, it can tell a legitimate admin action apart from a suspicious one, so you don't drown in alerts.

## Dive Deep

There are five file operations it now watches: open-for-write, rename, symlink, link, and unlink, the basic moves of opening a file for writing, renaming it, and creating or removing links.

The results show up as three finding types:

- `Persistence:Runtime/SensitiveFileModified`
- `PrivilegeEscalation:Runtime/SensitiveFileModified`
- `DefenseEvasion:Runtime/SensitiveFileModified`

Just reading the name tells you which stage of an attack you're looking at. You can learn how to read these in the [Amazon GuardDuty Findings](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html) docs, and how to get notified via the [Amazon GuardDuty SNS topic](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html) page.

It's available if you've enabled GuardDuty Runtime Monitoring for EC2, EKS, or ECS workloads, and new users get a 30-day free trial to ease into it.

## Wrap-up

- GuardDuty Runtime Monitoring added three threat detections for sensitive file changes
- It watches five operations: open-for-write, rename, symlink, link, and unlink
- Findings come in three types (Persistence, PrivilegeEscalation, DefenseEvasion) so you can see the attack stage
- The trick is catching obfuscated-command attacks by watching file operations instead
- Aimed at teams running EC2, EKS, or ECS with Runtime Monitoring, with a 30-day free trial for newcomers

If you run EC2 or containers in production and want eyes on what happens after a breach, this one's for you!