GuardDuty detector has Malware Protection for EC2 enabled

Check ID: guardduty_ec2_malware_protection_enabled
Provider: AWS
Service: guardduty
Severity: HIGH
Resource type: AwsGuardDutyDetector

What this check verifies

GuardDuty detectors with Malware Protection for EC2 enabled perform agentless scans of EBS volumes attached to EC2 instances and container workloads. Scans can be triggered by suspicious activity or run on-demand to identify malicious files within restored volume snapshots.

Risk

Absent this coverage, malware on EC2 or containers can remain undetected, enabling:

Confidentiality loss via data exfiltration/credential theft
Integrity compromise through tampering and backdoors
Availability impact from ransomware/cryptominers

Persistence increases lateral movement across the environment.

Recommendation

Enable Malware Protection for EC2 across all accounts and Regions under centralized administration. Apply least privilege to findings access, define scan scope with tags and minimize exclusions, and retain snapshots based on data sensitivity. Integrate alerts with IR/SIEM and pair with hardening and vulnerability scanning for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"EBS_MALWARE_PROTECTION","Status":"ENABLED"}]'

# Enable GuardDuty Malware Protection for EC2
resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true

  features {
    name   = "EBS_MALWARE_PROTECTION"  # Critical: selects EC2 Malware Protection feature
    status = "ENABLED"                  # Critical: enables the feature
  }
}

# CloudFormation: enable GuardDuty Malware Protection for EC2
Resources:
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: EBS_MALWARE_PROTECTION  # Critical: selects EC2 Malware Protection feature
          Status: ENABLED               # Critical: enables the feature

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = guardduty_ec2_malware_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

GuardDuty delegated admin is enabled in all regions GuardDuty detector has EKS Audit Log Monitoring enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires