Join us for this hands-on lab where you learn about Amazon GuardDuty by walking through some real-world threat scenarios. Learn about the threat detection capabilities of GuardDuty and the available remediation options. We first go through a scenario where an Amazon EC2 instance is compromised, followed by one where IAM credentials are compromised. In each scenario, we look at a method to remediate the threat. We use the following services: AWS CloudFormation, AWS CloudTrail, Amazon VPC flow logs, Amazon CloudWatch events, Amazon SNS, Amazon S3, AWS Lambda, and, of course, Amazon GuardDuty. Be sure you have an AWS account to do the lab. This should be your own personal account and not an account through your company. We provide AWS credits to help cover any costs incurred during the lab.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Greg McConnel
Security Solutions Architect
Jesse Fuchs
Security Solutions Architect
SID304
Threat Detection and Remediation with
Amazon GuardDuty

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
• Introduction to GuardDuty - 20 min
• Intro to Lab 1 - 10 min
• Lab 1 – Discovery & Remediation – EC2 - 35 min
• Intro to Lab 2 - 10 min
• Lab 2 – Discovery & Remediation – IAM - 40 min
• Summary & Closing - 5 min

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Introduction
Quick intro – very quick, I promise …

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Role Playing Demo

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Now some slides!

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
You Never Know What You’ll Find
Vs.

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Threat Detection
Amazon GuardDuty is a managed threat detection
service that continuously monitors for malicious
or unauthorized behavior to help you protect your
AWS accounts and workloads.

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Threat Detection

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Summary
AWS
Accounts
Threat
Detection
Types
Data
Sources
Findings
Trusted &
Threat IP
Lists
Pricing

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
GuardDuty Updates and Resources
12 new detections!
https://aws.amazon.com/blogs/security/why-we-reduce-complexity-and-rapidly-
iterate-on-amazon-guardduty-twelve-new-detections-added/
All findings:
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html
GuardDuty to Slack Integration: https://github.com/aws-samples/amazon-
guardduty-to-slack
Multi Account script: https://github.com/aws-samples/amazon-guardduty-
multiaccount-scripts
GuardDuty Testing Scripts: https://github.com/awslabs/amazon-guardduty-tester

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Questions
• How soon before enabling GuardDuty do you need to enable VPC Flow
Logs?
• Which services does GuardDuty report findings on?
• Which services can you remediate threats found by GuardDuty?
• How can you calculate the cost of GuardDuty?
• What performance impact does GuardDuty have on your account if you have
more than 100 VPCs?

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab
http://lab.gregmcconnel.net/

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 1
http://lab.gregmcconnel.net/

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Lab 1
The first lab will generate GuardDuty findings when an EC2 instance attempts to connect to an IP in a
customer Threat List. We will assume this instance is compromised and isolate it using a Security Group.
Here are the steps:
• Environment Setup – Create Elastic IP address, and add this to a Custom Threat List. Run an AWS
CloudFormation template.
• Attack Simulation – In the background, the ”Compromised” instance will connect with the “Malicious”
instance, generating GuardDuty findings.
• Remediation – A Lambda function will be added that will remove the ”Compromised” instance from its
current security group and add it to one with no Ingress or Egress rule.
• Extra Credit – Enhance the Lambda function to take additional actions on the ”Compromised” instance.

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Lab 1 Part 1

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Lab 1 Part 2

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lab 2
http://lab.gregmcconnel.net/

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Lab 2
For the second lab, you will be focused on generating and remediating GuardDuty findings related to
compromised IAM credentials. Below are the steps you’ll be walking through:
• Environment Setup – Run the AWS CloudFormation template and create the additional resources.
• Attack Simulation – Set up a profile for stolen EC2 credentials, and use the AWS CLI to see what you
have access to.
• Remediation – Review the auto remediation Lambda function and other recommended remediations.
Answer questions related to how you would remediate these within your own company.
• Extra Credit – Enhance the Lambda function to output a more granular alert, process other GuardDuty
findings, or rotate Instance Profiles to limit downtime of an application.

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Lab 2

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Lab
Discussion

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Next Steps
Enable GuardDuty – Monitor the cost and findings during the 30-day no-
cost trial period. Assess after 30 days where GuardDuty will sit in your
overall security strategy.
https://aws.amazon.com/guardduty/

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Please complete the session survey in the
summit mobile app.

23. Submit Session Feedback
1. Tap the Schedule icon. 2. Select the session
you attended.
3. Tap Session
Evaluation to submit your
feedback.

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!