JUSTIN SAMUEL

What is Amazon GuardDuty?

Intelligent Threat Detection service.
Detects malicious activity in your AWS account.
- Examples include: cryptomining, data exfil, compromised AWS credentials or account
Uses AI, machine learning, anomaly detection, malicious file discovery.
One-click to enable.
Analyses data sources:
- Examples:
  - CloudTrail Management Events – anomalous API calls, unauthorised deployments
  - VPC Flow Logs – anomalous traffic, strange IP addresses
  - Route 53 DNS Query Logs – compromised EC2 instances sending encoded data within DNS queries
Includes Extended Threat Protection.
- Detects multi-stage attacks spanning multiple data sources and EC2 instances

GuardDuty Protection Plans:
- Malware Protection for EC2 – scans EBS volumes to detect malware
- EKS Protection – monitors Kubernetes audit logs from EKS clusters for suspicious activities
- Runtime Monitoring – monitors OS-level events on EC2, ECS, EKS for threats
- Lambda Protection – analyses Lambda network activity logs using VPC Flow Logs to detect threats such as cryptomining or communications with known malicious servers
- S3 Protection – identifies security risks in S3 buckets such as data exfil
- Malware Protection for S3 – identifies malware in S3 buckets
- Malware Protection for AWS Backup – scans Backup resources (ex. EBS Snapshots, AMIs) for malware
- RDS Protection – analyses RDS and Aurora login activity for threats

GuardDuty Findings
- Findings are generated by GuardDuty from data streams (ex. CloudTrail logs, VPC Flow Logs). Findings severity ranges from 0.1 -> 8+.
- Example:
  - ThreatPurpose:ResourceTypeAffected/ThreatFamilyName.DetectionMechanism!Artifact
  - ThreatPurpose – purpose of threat (ex. cryptomining, backdoor)
  - ResourceTypeAffected – which AWS resource is targeted (ex. EC2, S3)
  - ThreatFamilyName – describes potential malicious activity (ex. NetworkPortUnusual)
  - DetectionMechanism – method GuardDuty used to detect finding (ex. TCP, UDP)
  - Artifact – describes resources used in malicious activity (ex. DNS)
- You can use EventBridge to automate responses to security findings. SNS (Simple Notification Service) to send emails or Slack alerts.