Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Custom Detection Rules finding types

This page lists the finding types that GuardDuty generates from Custom Detection Rules, grouped by data source. Each finding type aggregates one or more signals into a single finding. For more information about enabling Custom Detection Rules, see Custom Detection Rules in GuardDuty.

Custom Detection Rules for Amazon CloudTrail management events

The following finding types are generated from Amazon CloudTrail management event signals, organized by MITRE ATT&CK® tactic.

Credential Access

These rules attempt to detect operations that retrieve or reset credentials, such as retrieving an Amazon EC2 instance password or resetting an Amazon RDS administrator password.

Defense Impairment

These rules attempt to detect changes that disable or weaken security controls, such as deleting VPC flow logs, disabling an organization policy, or removing an account from an organization.

Execution

These rules attempt to detect changes that run code on a resource, such as modifying a SageMaker AI notebook lifecycle configuration.

Exfiltration

These rules attempt to detect changes that share resources outside your account, such as making an AMI, Amazon EBS snapshot, or Amazon RDS snapshot accessible to other accounts.

Impact

These rules attempt to detect changes that could disrupt or destroy data and resources, such as setting Amazon S3 objects to expire quickly, or enabling Amazon SES sending.

Initial Access

These rules attempt to detect activity that opens access to your environment, such as a console sign-in without MFA or making an Amazon RDS database publicly accessible.

Lateral Movement

These rules attempt to detect activity that grants access between resources, such as pushing an SSH key to an Amazon EC2 instance.

Persistence

These rules attempt to detect changes that create or extend access, such as creating IAM access keys, modifying a role trust policy, or making a Lambda function publicly accessible.

Privilege Escalation

These rules attempt to detect changes that grant broader permissions, such as attaching an administrator policy to an IAM user or role.

Resource Development

These rules attempt to detect setup of resources that could support later activity, such as verifying an Amazon SES domain identity.