Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring

Amazon GuardDuty now supports optional detection rules for Runtime Monitoring to identify suspicious activity across compute environments.

• Over 50 new Runtime Monitoring rules detect process, file, and network activity indicative of compromise
• Covers EC2 instances, Amazon EKS, and ECS on both EC2 and AWS Fargate
• Spans 13 finding types mapped to MITRE ATT&CK tactics including persistence, privilege escalation, and command and control
• Introduces four new finding types: CommandAndControl, CredentialAccess, Discovery, and Exfiltration variants
• Dry-run mode available to evaluate detection efficacy before enabling live detection
• Available in all AWS commercial Regions and AWS GovCloud (US)

These optional rules enhance GuardDuty's runtime threat detection capabilities across multiple AWS compute services.