- Added three Runtime Monitoring detections (Persistence, PrivilegeEscalation, DefenseEvasion) that trigger on sensitive file modifications in EC2, EKS, and ECS workloads.
- Monitors five file operations (open‑for‑write, rename, symlink, link, unlink) to detect post‑compromise activity while reducing false positives via correlation analysis.
- Available to all GuardDuty customers with Runtime Monitoring enabled, includes MITRE ATT&CK mapping and a 30‑day free trial for new users.
Amazon GuardDuty adds sensitive file modification threat detections
Official AWS changelog summary with source attribution, release tags, and community reactions.
Track this AWS release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
More AWS changelog updates
Introduces Stream Session Admin Shell, a secure terminal for live stream session debugging via the new CreateStreamSessionAdminShell API
Community impact
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.