- Added three Runtime Monitoring detections (Persistence, PrivilegeEscalation, DefenseEvasion) that trigger on sensitive file modifications in EC2, EKS, and ECS workloads.
- Monitors five file operations (open‑for‑write, rename, symlink, link, unlink) to detect post‑compromise activity while reducing false positives via correlation analysis.
- Available to all GuardDuty customers with Runtime Monitoring enabled, includes MITRE ATT&CK mapping and a 30‑day free trial for new users.
Amazon GuardDuty adds sensitive file modification threat detections
Official AWS changelog summary with source attribution, release tags, and community reactions.
Track this AWS release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
More AWS changelog updates
Increased default runtime quota limits for AgentCore, allowing up to 5,000 concurrent sessions in US East/West regions and 2,500 in other regions
Community impact
Community ratings: 0 Useful, 0 Noise, 0 Risky, 0 Broke, 0 Try.