GuardDuty AttackSequence Critical — Compromised EC2 InstanceGroup or ECS Cluster

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•5

Detects high severity (>= 9.0) AWS GuardDuty findings indicating that an EC2 instance or ECS cluster has been compromised, typically suggesting active exploitation or control by a malicious actor.