☁️
CTHFM: AWS
  • Welcome
  • Getting Started
    • Account Setup
  • AWS CLI
    • AWS CLI Overview
    • Installation
  • AWS Fundamentals
    • AWS Documentation
    • AWS Shared Responsibility Model
    • Organizational Hierarchy
    • AWS Principals
    • IAM Fundamentals
      • IAM Policy Components
      • IAM Documentation References
    • AWS Security Services Overview
    • AWS Core Services
    • AWS Frameworks
    • Regions and Availability Zones
  • SQL
    • SQL Refresher for Threat Hunting
  • Logging Reference
    • Cloudtrail
      • What is Cloudtrail?
      • Setting Up Cloudtrail
      • Cloudtrail Events Structure
      • Filtering and Searching CloudTrail Logs
      • IAM ID Prefixes
      • Additional Resources
      • API References
    • VPCFlow Logs
    • GuardDuty
      • Multi-Account Setup
      • GuardDuty Concepts
      • GuardDuty Finding References
      • S3 Protection
      • Malware Protection
        • EC2 Malware Protection
          • EC2 Protection Resources
          • Monitoring Scans
          • EC2 Malware Protection Events: CloudWatch
        • S3 Malware Protection
          • Enabling S3 Malware Protection
          • After Enabling S3 Malware Protection
          • S3 Malware Resource Plan Status
          • S3 Malware Protection Quotas
      • RDS Protection Enablement
      • Lambda Protection Enablement
      • Trusted IP Lists and Threat Lists in Amazon GuardDuty
      • Remediation Recommendations
      • GuardDuty API Reference
      • GuardDuty Quotas
    • Access Analyzer
      • Setup
      • External Access and Unused Access Analyzer Findings
      • Review Findings
      • Access Analyzer Resources
      • Access Analyzer API Reference
    • AWS Network Firewall
      • Permissions
      • Firewall Log Contents
      • Logging Destinations
      • CloudWatch Firewall Metrics
    • AWS Config
      • Resource Management in AWS Config
      • AWS Config Integrations
      • AWS Config Resources
      • Configuration Item
      • Config Rules
        • Evaluation Modes
  • CloudWatch
    • Amazon CloudWatch
      • CloudWatch Concepts
      • CloudWatch Metrics
        • Filter Pattern Syntax
      • CloudWatch Alarms
        • Alarm Recommendations
      • Subscriptions
      • CloudWatch Agent
      • CloudWatch Insights
        • Supported Logs and Discovered Fields
        • CloudWatch Insights Query Syntax
      • Anomaly Detection
        • Create Anomaly Detector
        • Alarms for Anomaly Detections
      • CloudWatch Filter Syntax
      • CloudWatch Service Quota
  • Athena For Threat Hunting
    • Introduction to Athena
    • Setting Up Athena
    • SQL For Threat Hunters
    • Automated Response
    • Query Best Practices
  • AWS Security Research and Resources
    • AWS Security Blog
    • AWS Goat
    • Cloud Goat
    • Pacu
    • Prowler
    • Scout Suite
  • Threat Hunting in AWS
    • Threat Hunting in AWS
    • Threat Hunting Introduction
    • Threat Hunting Process
      • Hypothesis Generation
      • Investigation
      • Identification
      • Resolution & Follow Up
    • Pyramid of Pain
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Att&CK Data Sources
      • MITRE Att&CK Mitigations
    • MITRE Att&ck: AWS
      • MITRE Att&CK Matrix
      • Amazon Web Services Security Control Mappings
    • AWS Threat Hunting Ideas
      • AWS Threat Hunting Ideas: EC2
      • AWS Threat Hunting Ideas: Lambda
      • AWS Threat Hunting Ideas: SQS
      • AWS Threat Hunting Ideas: SNS
      • AWS Threat Hunting Ideas: RDS
Powered by GitBook
On this page
  • Overview
  • Scan Types:
  • EBS Volume Scanning and Snapshots:
  • Limitations:
  • Summary of Key Features:
  1. Logging Reference
  2. GuardDuty
  3. Malware Protection

EC2 Malware Protection

Overview

Malware Protection for EC2 detects malware by scanning Amazon Elastic Block Store (EBS) volumes attached to Amazon EC2 instances and container workloads. It offers flexibility to include or exclude specific instances and provides an option to retain EBS snapshots when malware is detected. The service is integrated with Amazon GuardDuty and does not impact system performance.

Scan Types:

  1. GuardDuty-Initiated Malware Scan:

    • Trigger: Automatically initiates when GuardDuty generates a finding indicating potential malware.

    • Frequency: Once every 24 hours per resource.

    • Configuration: Must be enabled for each account or AWS Organization.

    • Free Trial: 30-day trial for new accounts when this scan type is enabled.

    • Scan Options: Supports exclusion of resources using user-defined tags.

  2. On-Demand Malware Scan:

    • Trigger: Manually initiated by providing the Amazon Resource Name (ARN) of the EC2 instance.

    • Frequency: Can be initiated any time after one hour from the previous scan.

    • Configuration: No feature-level setup required.

    • Free Trial: No free trial for this scan type.

    • Tagging: Does not support user-defined tags but honors the global GuardDutyExcluded tag.

EBS Volume Scanning and Snapshots:

  • EBS Volume Scanning: Scans volumes attached to EC2 instances or container workloads.

  • Snapshot Retention:

    • Snapshots are created during both types of scans and are retained only if malware is detected.

    • If no malware is found, snapshots are deleted, even if the retention setting is enabled.

    • By default, the snapshot retention setting is disabled but can be manually activated.

  • Replica EBS Volume Management:

    • GuardDuty creates encrypted replicas of EBS volumes for scanning and retains them for up to 55 hours.

    • If there is an outage or failure, volumes may be retained for up to 7 days for triage.

Limitations:

  • Unsupported Workloads: Does not support Fargate with Amazon ECS or Amazon EKS.

  • Regional Availability: Malware Protection must be enabled on a per-region basis within GuardDuty.

Summary of Key Features:

  • Performance Impact: Designed to operate without affecting system performance.

  • Automation and Flexibility: Supports automatic and on-demand scans with tagging options for resource management.

  • Data Management: Snapshots and encrypted replicas are managed efficiently to ensure security, with options to retain evidence in case of malware detection.

PreviousMalware ProtectionNextEC2 Protection Resources

Last updated 8 months ago