AWS GUARDDUTY
Tags: aws, awssecurity, community
Published: 2024-04-20 08:53:33

**<u>What is Amazon GuardDuty?</u>**
Amazon GuardDuty is a pay-as-you-go threat detection service that continuously monitors for malicious activity and anomalous behavior to help protect your AWS accounts, workloads, and data. It continuously monitors and analyzes activity within your AWS environment to identify potentially malicious or unauthorized behavior. GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as unusual API calls, potentially compromised instances, unauthorized access attempts, and instances of cryptocurrency mining.

**<u>BENEFITS OF GUARDDUTY</u>** 

1. Continuous Monitoring: GuardDuty continuously analyzes events and log data from various AWS data sources including AWS CloudTrail, Amazon VPC Flow Logs, and DNS logs to detect potential security threats.
2. Threat Detection: It uses a combination of signature-based detection, anomaly detection, and machine learning algorithms to identify potential security threats and suspicious activities within your AWS environment.
3. Integrated Threat Intelligence: GuardDuty integrates with AWS Security Hub and AWS Lambda to provide threat intelligence feeds from AWS, as well as third-party sources, to enhance threat detection capabilities.
4. Centralized Dashboard: GuardDuty provides a centralized dashboard where you can view security findings, prioritize alerts based on severity, and investigate security incidents.

5. Automated Remediation: GuardDuty can automatically respond to certain types of security threats by triggering AWS Lambda functions or AWS CloudWatch Events to initiate automated remediation actions.


**<u> WHAT IS GUARDDUTY FINDINGS</u>** 
**Findings** indicate potential security issues due to malicious activity occurring in your AWS account.

**Below are the types of Amazon GuardDuty findings :**

**_1.Malware protection_**
GuardDuty will flag suspicious files installed on an EC2 instance.

**_2.RDS Protection_**
It will detect any anomalous behaviour, such as failed login attempts to the Relational Database.

**_3.EC2  Finding Types_**
  Unauthorized access to EC2 instance using SSH bruteforce

**_4.IAM  Finding Types_** 
  IAM user disabling CloudTrailLogging, IAMuser using root credentials

**<u>The Malware Detection on EC2 instance as a use case and the following is a walk through guide</u>**
Guardduty can be used to scan EC2 instance workload to detect and flag any threat .
**_Below are the steps to implement this :_**
        NETWORK DIAGRAM

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/acx8m4f5ascwylxzpu0x.png)



**_a. Enable Guardduty on your account by click on  Get Started_**

- Open the GuardDuty console at https://console.aws.amazon.com/guardduty/
- Choose Get Started.
- Choose Enable GuardDuty.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/42sqvd0jtr38bp8fmguy.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yr8y5acvg2gmprgdcsgu.png)


**_b. Launch Microsoft window server  and download a test malware on it._**
  The malware will not be detected automatically until you scan it with guard duty.

   
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ceo39l5dpyl2yd7e9jha.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bvzo34esysgfri890ntj.png)

**_c. Malware scan with Guardduty_**

Using the Malware Scans page:

In the navigation pane, choose Malware Scans.

Choose Start on-demand scan and provide the Amazon EC2 instance ARN1 for which you want to initiate the scan.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4x978f6bh7c7j6fz9h3o.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wnc894475q1ybbfjfnbg.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ui545tfnuyia9qe1xkqa.png)

**_d. The result after the GuardDuty scan reveals that a threat was found on the Windows server that was scanned, requiring urgent attention._**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a5hig65gshtkw6btvrtu.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/48liblvt93s22wd54rt8.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/82ug7c4r6q56s44nlm9h.png)

**CONCLUSION**
Amazon GuardDuty has a variety of applications, one of which is malware detection, as explained in detail above. Feel free to follow these steps and practice on your own. Amazon GuardDuty offers 30 days of free use for you to explore and learn various uses of the tool. Thank you for your time; we would also appreciate your feedback and contribution.