GuardDuty-initiated malware scan - Amazon GuardDuty

GuardDuty-initiated malware scan

With GuardDuty-initiated malware scan enabled, whenever GuardDuty detects malicious activity that indicates the potential presence of malware in your Amazon EC2 instance or container workload and GuardDuty generates Findings that invoke GuardDuty-initiated malware scan, GuardDuty automatically initiates an agentless scan on the Amazon Elastic Block Store (Amazon EBS) volumes attached to the potentially impacted Amazon EC2 instance or container workload to detect the presence of malware. With scan options, you can add inclusion tags associated with the resources that you want to scan or add exclusion tags associated with the resources that you want to skip from the scanning process. An automatic scan initiation will always consider your scan options. You can also choose to turn on the snapshots retention setting to retain the snapshots of your EBS volumes only if Malware Protection for EC2 detects the presence of malware. For more information, see Customizations in Malware Protection for EC2.

For each Amazon EC2 instance and container workload for which GuardDuty generates findings, an automatic GuardDuty-initiated malware scan gets invoked once every 24 hours. For information about how the Amazon EBS volumes attached to your Amazon EC2 instance or container workload are scanned, see Feature in Malware Protection for EC2.

The following image describes how GuardDuty-initiated malware scan works.

To initiate automatic scans on your EC2 containers and EBS volumes, turn on GuardDuty-initiated malware scan with a single click. The scan takes place offline with no impact on performance. Similar to other GuardDuty findings, you can review malware-related findings by integrating with Security Hub, EventBridge, and Detective.

When malware is found, GuardDuty generates Malware Protection for EC2 finding types. If GuardDuty doesn't generate a finding indicative of malware on the same resource, no GuardDuty-initiated malware scan will be invoked. You can also initiate an On-demand malware scan on the same resource. For more information, see On-demand malware scan.