AWS GuardDuty Malicious or Suspicious File Executed

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•34

This rule detects when Amazon GuardDuty identifies a malicious or suspicious file being executed on an Amazon EC2 instance or a container workload. It specifically looks for GuardDuty findings with product event types 'MaliciousFile' or 'SuspiciousFile', excluding any sample findings.