AWS has added more than 50 optional detection rules to GuardDuty Runtime Monitoring, covering activity that may be routine in one environment but signal a compromise in another. Teams can test the rules in dry-run mode before switching on live detections, giving security operators a chance to assess the results first.
Watch Desk analysis
What happened
The rules cover Amazon EC2 and Amazon EKS, as well as Amazon ECS running on EC2 or AWS Fargate. They span 13 finding types mapped to MITRE ATT&CK tactics including persistence, privilege escalation, execution, defence evasion, discovery, exfiltration and command and control.
AWS says the release adds four finding types: suspicious commands associated with command and control; sensitive-file reads associated with credential access or discovery; and suspicious commands associated with exfiltration. The custom detection rules are available in all AWS commercial Regions and AWS GovCloud (US) Regions.
Why it matters
Runtime monitoring is about what processes, files and network connections are doing while systems are running. The new rules give teams more ways to flag behaviour that might otherwise blend into the local routine, particularly when they need to look for specific activity across cloud workloads.
The dry-run option is the practical point: teams can evaluate how the rules behave in their own environments before enabling live detections. That matters because a suspicious-looking action can be legitimate in one system and a warning sign in another. More alerts are not automatically better; security teams already have enough ways to acquire a full inbox.
Our read
This is a useful expansion for organisations already using GuardDuty Runtime Monitoring, especially those that want to test detection coverage before putting new rules into live operation. The sensible move is to start in dry-run mode, see what the rules flag in your environment, and then decide which detections belong in the live workflow.
What to watch
- How teams use dry-run results to tune or select rules before enabling live detection.
- Whether AWS adds further finding types or expands the supported workloads and regions.
- How operators balance broader detection coverage against alert volume and investigation effort.
Discussion spark: When testing new runtime detections, should teams prioritise catching more suspicious activity or keeping false alarms low enough that important alerts do not get lost?
Sources and evidence
- Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring (19 October 2026, 16:01 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.