Amazon GuardDuty adds sensitive file modification threat detections

Amazon GuardDuty Runtime Monitoring now includes three new threat detections that alert security teams when sensitive files are modified on EC2 instances and container workloads.

• Detects Persistence, PrivilegeEscalation, and DefenseEvasion tactics through sensitive file modifications
• Monitors five file operations: open-for-write, rename, symlink, link, and unlink
• Works on EC2, Amazon EKS, and Amazon ECS workloads
• Bypasses obfuscated techniques that evade command-line monitoring
• Includes MITRE ATT&CK mapping and remediation recommendations
• 30-day free trial available for new users

These findings help security teams identify post-compromise attacker activities and reduce false positives through correlation-based analysis.