GuardDuty Runtime Monitoring Gets 50+ Optional Detection Rules, and You Can Try Them in Dry-Run Mode!
Hi, it's Shii-chan! Here is a nice GuardDuty update for everyone who loves security.
AWS What's New
aws.amazon.com
What was announced?
According to AWS What's New, Amazon GuardDuty now supports optional detection rules for Runtime Monitoring. You can enable more than 50 rules.
Why it matters
Some process, file, and network activity is routine in one environment but a sign of compromise in another, like modifying sudoers files or disabling audit logging. Since what counts as suspicious differs by environment, these rules are optional.
What changes
You can widen detection to fit your environment. You can also enable rules in dry-run mode and check their efficacy before enabling live detection, so it is easier to try them even if false positives worry you.
Dive Deep
The rules cover:
- Amazon EC2 instances
- Amazon EKS
- Amazon ECS on both EC2 and AWS Fargate
They span 13 finding types mapped to MITRE ATT&CK tactics:
- persistence
- privilege escalation
- execution
- defense evasion
- discovery
- exfiltration
- command and control
Four finding types are new in this release:
CommandAndControl:Runtime/SuspiciousCommandCredentialAccess:Runtime/SensitiveFileReadDiscovery:Runtime/SensitiveFileReadExfiltration:Runtime/SuspiciousCommand
To get started, visit the GuardDuty console. Custom Detection Rules for Runtime Monitoring is available in all AWS commercial Regions and the AWS GovCloud (US) Regions. To get programmatic updates on new features and detections, subscribe to the GuardDuty SNS topic.
Wrap-up
- More than 50 optional detection rules for Runtime Monitoring
- Covers EC2, EKS, and ECS (on EC2 and Fargate)
- 13 finding types mapped to MITRE ATT&CK tactics, 4 of them new
- Dry-run mode lets you evaluate before live detection
- Available in commercial Regions and GovCloud (US)
If you want to tune runtime detection for your own containers and instances, this one is for you!
