Learning Objectives: - Learn how GuardDuty continuously monitors for unauthorized behavior to help protect AWS accounts and workloads - Understand how GuardDuty uses machine learning to detect anomalous account and network activities - See how a SOC team can triage threats from a single console and automate security responses

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Nathan Case
Deep Dive on Amazon GuardDuty
Needle.needle.needle…wait these are all needles…
February, 2018

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Deep Dive on Amazon GuardDuty
1. Intro
2. Discussion of the Services Used
• Amazon GuardDuty
• Amazon CloudWatch
• AWS Lambda
3. Inspection of the Needles
4. What to do about them
5. What to do with the Red Needle
6. Auto Remediation
Amazon GuardDuty

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Find the Needle, Skip the Haystack
GuardDuty helps security professionals quickly find the threats (needle) to
their environments in the sea of log data (haystack) so they can focus on
hardening their AWS environments and responding quickly to malicious or
suspicious behavior.
Amazon GuardDuty:
All Signal, No Noise

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Threat Detection and Notification

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Account Relationships
• Adding accounts to the services is simple and done via the console or API.
• Invites accepted from an account will be designated as “Member” accounts. The requestor
will be the “Master” account.
Master Account
Can Do the Following to ALL accounts:
• Generate Sample Findings
• Configure and View/Manage Findings
• Suspend GuardDuty Service
• Upload and Manage Trusted IP and
Threat IP Lists (coming soon!)
Can only disable own account. Member
accounts must all be removed first and by the
member account.

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Threat Detection and Notification

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Data Sources
VPC Flow Logs
VPC flow logs
• Flow Logs for VPCs Do Not Need to
Be Turned On to Generate Findings,
data is consumed through
independent duplicate stream.
• Suggested Turning On VPC Flow Logs
to Augment Data Analysis (charges
apply).
DNS Logs
DNS Logs
• DNS Logs are based on queries made
from EC2 instances to known
questionable domains.
• DNS Logs are in addition to Route 53
query logs. Route 53 is not required
for GuardDuty to generate DNS based
findings.
CloudTrail Events
CloudTrail Events
• CloudTrail history of AWS API calls used
to access the Management Console,
SDKs , CLI, etc. presented by
GuardDuty.
• Identification of user and account
activity including source IP address used
to make the calls.
Capture and save all event data via CWE or API Call for long term retention. Additional charges apply.

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Threat Detection and Notification

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Findings: Threat Purpose Details
• Backdoor: resource compromised and capable of contacting source home
• Behavior: activity that differs from established baseline
• Crypto Currency::detected software associated with Crypto currencies
• Pentest::activity detected similar to that generated by known pen testing tools
• Recon: attack scoping vulnerabilities by probing ports, listening, database tables, etc.
• Stealth::attack trying to hide actions / tracks
• Trojan::program detected carrying out suspicious activity
• Unauthorized Access::suspicious activity / pattern by unauthorized user
Describes the primary purpose of the threat. Available at launch, more coming!

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CONFIDENTIAL - © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Findings: Console / API
AWS Management Console API / JSON Format
Quickly See Threat
Information Including:
• Severity
• Region
• Count/Frequency
• Threat Type
• Affected Resource
• Source Information
• Viewable via
CloudWatch Events
Export Finding Data for
Further Analysis Including:
• Ingest into SIEM
• Data Enrichment
• Programmatic Response
• Additional Information
• ARN
• Span of Time
• Resource Info

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Findings: Severity Levels
LOW MEDIUM HIGH
Suspicious or malicious activity
blocked before it compromised
a resource.
Suspicious activity deviating
from normally observed
behavior.
Resource compromised and
actively being used for
unauthorized purpose.
Suggestion:
Take Immediate Action(s)
• Terminate instance(s)
• Rotate IAM access keys
Suggestion:
Investigate Further
• Check new software that
changed the behavior of a
resource
• Check changes to settings
• AV scan on resource (detect
unauthorized software)
• Examine permissions attached
to IAM entity implicated
Suggestion:
Take Immediate Action(s)
• No immediate recommended
steps – but take note of info as
something to address in the
future

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Threat Detection Type by API group
Backdoor CryptoRecon
Stealth
Recon
UnauthorizedAccess
EC2/XORDDOS
EC2/Spambot
EC2/C&CActivity.B!DNS
:EC2/PortProbeUnprotectedPort
:IAMUser/TorIPCaller
:IAMUser/MaliciousIPCaller.Custom
:IAMUser/MaliciousIPCaller
:EC2/Portscan
:EC2/BitcoinTool.B!DNS
Trojan
:EC2/PortProbeUnprotectedPort
:IAMUser/TorIPCaller
:IAMUser/MaliciousIPCaller.Custom
:IAMUser/MaliciousIPCaller
:EC2/Portscan
:IAMUser/PasswordPolicyChange
:IAMUser/CloudTrailLoggingDisabled
Behavior
:IAMUser/TorIPCaller
:IAMUser/MaliciousIPCaller.Custom
:IAMUser/ConsoleLoginSuccess.B
:IAMUser/MaliciousIPCaller
:IAMUser/UnusualASNCaller
:EC2/TorIPCaller
:EC2/MaliciousIPCaller.Custom
:EC2/SSHBruteForce
:EC2/RDPBruteForce
:IAMUser/InstanceCredentialExfiltration
:IAMUser/InstanceLaunchUnusual
:EC2/NetworkPortUnusual
:EC2/TrafficVolumeUnusual
PenTest:IAMUser/KaliLinux
:EC2/BlackholeTraffic
:EC2/DropPoint
:EC2/BlackholeTraffic!DNS
:EC2/DriveBySourceTraffic!DNS
:EC2/DropPoint!DNS
:EC2/DGADomainRequest.B
:EC2/DNSDataExfiltration
:EC2PhishingDomainRequest
:EC2/BlackholeTraffic!DNS
:EC2/DGADomainRequest.C!DNS

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GuardDuty Threat Detection and Notification

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Remediate a Compromised Instance
• Remediate Compromised AWS Credentials
Responding to Findings: Remediation
Automatic Remediation
GuardDuty CloudWatch Events Lambda
Amazon
GuardDuty
Amazon
CloudWatch
CloudWatch
Event
Lambda
Function
AWS Lambda

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
Lambda
function

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
Lambda
function

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
Lambda
function

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
elastic network
adapter
elastic network
adapter
Lambda
function

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
elastic network
adapter
elastic network
adapter
Lambda
function
EBS Volume

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
elastic network
adapter
elastic network
adapter
Lambda
function
EBS Volume
80, 443->DataSG

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
elastic network
adapter
elastic network
adapter
Lambda
function
EBS Volume
3389 -> 0.0.0.0/0
80, 443->DataSG

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
elastic network
adapter
Lambda
function
EBS Volume
80, 443->DataSG

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
top
Instance:~ ec2-user$
pcap
Instance:~ ec2-user$
lime
AWS
Lambda
Amazon
GuardDuty
elastic network
adapter
elastic network
adapter
Lambda
function
EBS Volume

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
top
Instance:~ ec2-user$
pcap
Instance:~ ec2-user$
lime
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS Volume EBS Forensics

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ top
Instance:~ ec2-user$ pcap
Instance:~ ec2-user$ lime
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS Volume

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS Volume
Amazon EBS
snapshot

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Account Planning
Production Account
Region of Choice
Availability Zone A Availability Zone B
Forensics Account
EBS Forensics EBS Forensics

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Account Planning
Production Account
Region of Choice
Availability Zone A Availability Zone B
Forensics Account EBS Forensics
EBS Forensics EBS Forensics

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IAM Policies
LAMBDA POLICY

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
IAM Policies
LAMBDA POLICY

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CloudWatch Rules
CloudWatch Dashboard POLICY

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CloudWatch Rules
CloudWatch Dashboard POLICY

33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo

34. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Remediation Actions
C: Remediate AWS credentials
PenTest:IAMUser/KaliLinux
Recon:IAMUser/TorIPCaller
Recon:IAMUser/MaliciousIPCaller
Recon:IAMUser/MaliciousIPCaller.Custom
Stealth:IAMUser/PasswordPolicyChange
Stealth:IAMUser/CloudTrailLoggingDisabled
UnauthorizedAccess:IAMUser/TorIPCaller
UnauthorizedAccess:IAMUser/MaliciousIPCaller
UnauthorizedAccess:IAMUser/MaliciousIPCaller.Custom
UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration
D: Investigate before Credential Remediation
Behavior:IAMUser/InstanceLaunchUnusual
UnauthorizedAccess:IAMUser/UnusualASNCaller
E: Architecture Change
Recon:EC2/PortProbeUnprotectedPort
A: Remediate Compromised Instances
Backdoor:EC2/XORDDOS
Backdoor:EC2/Spambot (spam)
Backdoor:EC2/C&CActivity.B!DNS
CryptoCurrency:EC2/BitcoinTool.B!DNS
Recon:EC2/Portscan
Trojan:EC2/BlackholeTraffic
Trojan:EC2/DropPoint
Trojan:EC2/BlackholeTraffic!DNS
Trojan:EC2/DriveBySourceTraffic!DNS
Trojan:EC2/DropPoint!DNS
Trojan:EC2/DGADomainRequest.B
Trojan:EC2/DNSDataExfiltration
UnauthorizedAccess:EC2/TorIPCaller
UnauthorizedAccess:EC2/MaliciousIPCaller.Custom
UnauthorizedAccess:EC2/SSHBruteForce
UnauthorizedAccess:EC2/RDPBruteForce
B: Investigate before EC2 Remediate
Behavior:EC2/NetworkPortUnusual
Behavior:EC2/TrafficVolumeUnusual

35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon GuardDuty Call to Action
Enable GuardDuty - monitor the cost and findings during the 30 day free
period – assess after 30 days where GuardDuty will sit in your overall
security strategy.
https://aws.amazon.com/guardduty/

36. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS