AWS GuardDuty Command and Control Activity Detected
This rule detects Command and Control (C2) activity identified by AWS GuardDuty across Amazon EC2, AWS Lambda, or Amazon EKS Runtimes. It specifically looks for GuardDuty findings with a product event type matching 'C&CActivity' and filters out sample findings. The rule aims to alert on suspicious communication patterns that indicate an adversary is controlling compromised resources within the AWS environment.
YARA-L
