AWS GuardDuty detects suspicious traffic from an instance with malware
Suspicious traffic was found by AWS GuardDuty service on EC2 instance {AwsEc2Instance} ({AwsEc2Instance.InstanceId}) detected with malware by Orca. AWS GuardDuty...
Blog
AWS GuardDuty detects RDP brute force attempts on an exposed unpatched Windows instance
Brute force attempts were detected by AWS GuardDuty service on the Internet facing Unpatched Windows EC2 instance {AwsEc2Instance} ({AwsEc2Instance.InstanceId}). AWS...
S3 Bucket with Policy:S3/BucketBlockPublicAccessDisabled GuardDuty Alert Found
GuardDuty finding was triggered for s3 bucket. It was found that the 'BucketBlockPublicAccessDisabled' feature was disabled for {AwsS3Bucket} bucket. This...
User with Stealth:IAMUser/CloudTrailLoggingDisabled GuardDuty Alert Found
GuardDuty finding was triggered for aws user.
Ec2 with Behavior:EC2/TrafficVolumeUnusual GuardDuty Alert Found
GuardDuty finding was triggered for ec2 instance.
Ec2 with CryptoCurrency:EC2/BitcoinTool.B GuardDuty Alert Found
GuardDuty finding was triggered for ec2 instance.
S3 Bucket with Policy:S3/BucketAnonymousAccessGranted GuardDuty Alert Found
GuardDuty finding was triggered for s3 bucket.
Ec2 with UnauthorizedAccess:EC2/SSHBruteForce GuardDuty Alert Found
GuardDuty finding was triggered for ec2 instance.