Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring

Summary

• Added optional runtime monitoring detection rules (50+) for process, file, and network activity across EC2, EKS, and ECS/Fargate.
• Introduced four new MITRE‑ATT&CK‑mapped finding types and a dry‑run mode to test detections before enabling live monitoring.
• Feature is available in all AWS commercial regions and GovCloud (US) regions.