Suspicious activity
AWS GuardDuty detects suspicious traffic from an instance with malware
Risk Level
Imminent Compromised (2)
Platform(s)
Compliance Frameworks
Brazilian General Data Protection (LGPD), CCM-CSA, CCPA, cis_8, CPRA, Data Security Posture Management (DSPM) Best Practices, GDPR, HITRUST, ISO/IEC 27001, Mitre ATT&CK, New Zealand Information Security Manual, NIST 800-171, NIST 800-190, NIST 800-53, PDPA, UK Cyber Essentials
Description
Suspicious traffic was found by AWS GuardDuty service on EC2 instance {AwsEc2Instance} ({AwsEc2Instance.InstanceId}) detected with malware by Orca. AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity. The service detected one of the following types of suspicious network: (CryptoCurrency:EC2/BitcoinTool.B!DNS, CryptoCurrency:EC2/BitcoinTool.B, Backdoor:EC2/C&CActivity.B!DNS, Backdoor:EC2/C&CActivity.B, Trojan:EC2/DGADomainRequest.B, Trojan:EC2/DGADomainRequest.C!DNS).
Personalized Demo
See Orca Security in Action
Gain visibility, achieve compliance, and prioritize risks with the Orca Cloud Security Platform.