Amazon GuardDuty Extended Threat Detection now supports Amazon EKS

AWS has enhanced Amazon GuardDuty Extended Threat Detection to support Amazon EKS security with advanced multi-stage attack detection capabilities.

• Correlates security signals across EKS audit logs, runtime behavior, malware execution, and AWS API activity
• Uses AI and machine learning to detect complex attack sequences across multiple resources
• Can identify sophisticated threats like privileged container deployments, crypto mining, and reverse shell creation
• Automatically generates critical-severity findings with detailed incident summaries and MITRE ATT&CK® mappings
• Enabled automatically for all GuardDuty customers at no additional cost
• Requires enabling GuardDuty EKS Protection and recommended Runtime Monitoring

The enhancement aims to help customers quickly identify and respond to sophisticated Kubernetes cluster attacks with minimal manual analysis.