Malware protection now a feature of Amazon GuardDuty

[AWS]

Amazon GuardDuty Malware Protection is now available, in Amazon GuardDuty, to help detect malicious files residing on an instance or container workload running on Amazon Elastic Compute Cloud (Amazon EC2) without deploying security software or agents. Amazon GuardDuty Malware Protection adds file scanning for workloads utilizing Amazon Elastic Block Store (EBS) volumes to detect malware that can be used to compromise resources, modify access permissions, and exfiltrate data. Malicious files that contain trojans, worms, crypto miners, rootkits, bots, and the like can be used to compromise workloads, repurpose resources for malicious use, and gain unauthorized access to data. Existing customers can enable the GuardDuty Malware Protection feature with a single click in the GuardDuty console or through the GuardDuty API. When threats are detected, GuardDuty Malware Protection automatically sends security findings to AWS Security Hub, Amazon EventBridge, and Amazon Detective. These integrations help centralize monitoring for AWS and partner services, automate responses to malware findings, and perform security investigations from the GuardDuty console. With the launch of Amazon GuardDuty Malware Protection there are eight new threat detections:

1. Execution:EC2/MaliciousFile
2. Execution:ECS/MaliciousFile
3. Execution:Kubernetes/MaliciousFile
4. Execution:Container/MaliciousFile
5. Execution:EC2/SuspiciousFile
6. Execution:ECS/SuspiciousFile
7. Execution:Kubernetes/SuspiciousFile
8. Execution:Container/SuspiciousFile

View the full article