AWS GuardDuty Penetration Testing Activity Detected

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•31

This rule detects penetration testing activity originating from known offensive security distributions like Kali Linux, Parrot Linux, or Pentoo Linux, as identified by Amazon GuardDuty. The detection is based on GuardDuty findings that specifically indicate 'PenTest' activity.