Announced in July 2026, new GuardDuty threat detections identify modifications indicative of attacker persistence, privilege escalation, or defense evasion by monitoring five specific file operations on Amazon EC2 instances and containers running on Amazon EKS or ECS. Alerts include contextual intelligence mapped to MITRE ATT&CK tactics and remediation guidance.
These enhancements aid security teams by spotting post-compromise behaviors that evade standard command-line monitoring, reducing false positives via correlation analysis. The detections are available to all GuardDuty Runtime Monitoring users with a free 30-day trial for new customers, improving visibility into critical system file integrity in cloud compute environments.
Source & further reading
Amazon GuardDuty adds sensitive file modification threat detections ↗Source published 2026-07-01. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.