The new optional rules monitor behaviors that might indicate compromise in environments, such as unauthorized modification of sudoers or audit logs, across EC2, EKS, ECS, and Fargate. These detections align with MITRE ATT&CK tactics including persistence, privilege escalation, and command and control.
Users can enable over 50 rules in dry-run mode to assess detection accuracy before full deployment. The update also added four new finding types specifically related to runtime activities. This capability is available in all AWS commercial and GovCloud Regions, offering enhanced runtime security visibility.
Source & further reading
Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring ↗Source published 2026-10-19. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.