Check provider logo

GuardDuty detector has Malware Protection for EC2 enabled

guardduty_ec2_malware_protection_enabled

Severityhigh
Serviceguardduty
by Prowler

GuardDuty detectors with Malware Protection for EC2 enabled perform agentless scans of EBS volumes attached to EC2 instances and container workloads. Scans can be triggered by suspicious activity or run on-demand to identify malicious files within restored volume snapshots.

Risk

Absent this coverage, malware on EC2 or containers can remain undetected, enabling:

  • Confidentiality loss via data exfiltration/credential theft
  • Integrity compromise through tampering and backdoors
  • Availability impact from ransomware/cryptominers

Persistence increases lateral movement across the environment.

Run this check with Prowler CLI

prowler aws --checks guardduty_ec2_malware_protection_enabled

Run in Prowler Cloud

Recommendation

Enable Malware Protection for EC2 across all accounts and Regions under centralized administration. Apply least privilege to findings access, define scan scope with tags and minimize exclusions, and retain snapshots based on data sensitivity. Integrate alerts with IR/SIEM and pair with hardening and vulnerability scanning for defense in depth.

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"EBS_MALWARE_PROTECTION","Status":"ENABLED"}]'

Native IaC
Terraform
Other
  1. In the AWS console, open GuardDuty
  2. In the left menu, select Protection plans > Malware Protection for EC2
  3. Click Enable, then Save

Source Code

Resource Type

AwsGuardDutyDetector

References