Hayden.
And welcome back.
Now, in today's video, we'll be discussing about a guard duty.
Now it is guard duty has been one of my favorite security services.
And generally, whenever we begin consulting in the organization, specifically the one that has been
breached, this is one of the first service that we enabled.
So let's look into why this service proves to be very important in the security area.
So the aid of this guard duty is a threat intelligence service by e w.
S, which monitors for malicious behavior to help customer protect their database workloads.
Now, your two words are a very important.
First one is threat, and second one is intelligence.
So when you discuss about threat, threat is not just associated with servers, but it is also associated
with humans.
So anything that can be harmful to a particular entity can be regarded as threat.
And intelligence is the way in which you can perceive a specific threat.
Now, speaking about guard duty, this can be better explained with this diagram.
When you have a guard duty service now guard duty service basically monitors for multiple log files.
So it can be cloud relevance, it can be VPC flow logs, it can be DNS logs.
Now, once it monitors all of them, it will go ahead and analyze it according to the rules that has
been configured.
And from these, it will go ahead and detect threats.
So threat can be bitcoin detected.
You have DNS exfiltration, which is a very interesting attack.
You have Trojans found, you have brute force and so on.
Now, generally, from what I have seen, the organizations who get breached nowadays, one of the first
thing that attackers do is they go ahead and do Bitcoin mining there.
And if you are able to detect Bitcoin mining within your organizational servers, chances are that the
servers are breached.
So this is one of the important rules that I have seen being triggered in a lot of organizations.
Again, DNS exfiltration is also very interesting attack where the data of the servers is sent via the
DNS packets.
Now these are some sample rules over here.
The guard duty supports a lot of other rules that we look in a moment.
So here is a sample screenshot of a guard duty finding.
So you will see that there are a lot of findings like unauthorized access, which is associated with
the RDP brute force.
You have the phishing, you have Bitcoin related alerts, you have brute force related alerts.
You have associated with both scams.
Specifically when someone is doing huge amount of port scan with tools like IMAP and so on.
So this is what a guard duty alert looks like.
Now if you see that guard duty categorizes the alerts into multiple findings.
So some can be critical, some can be important, some can be informational and so on.
So these findings are also categorized and along with that, some of the things are associated with
the resource.
So it also shows you in which resource it has detected cryptocurrency related threats.
So let's do one thing.
Let's quickly jump into the guard duty console so that we can understand on how this would work.
So this is a guard duty console and currently you see that there are certain alerts which are generated.
One of the alert is related to route credentials usage.
Then you have a pro unprotected port.
Generally, if you have misconfigured your firewall, then you have an interesting alert related to
the client line.
If someone is using Tor within your servers, then that kind of alert is also detected.
So let's open one of them over here and on the right hand side it basically gives you the information
related to it.
So if you go a bit down.
So with India, the action type is put underscore pro and it shows you the IP addresses which have been
doing certain amount of port scans on your server.
And it also shows you the country from which the originating IP is from.
In our case, it is China and it also shows you the associated ISP.
So this is a great deal of information that our security engineer would really need.
Now, as we are discussing that the guard duty basically categorizes the alerts into multiple severity.
So if you look into the high severity alert, this is the one which is Tor client, then you also have
the one associated with a medium severity.
You also have one associated with the low severity.
Now, again, low severity does not mean that no action needs to be taken.
So, for example, this unprotected port, this is one of the alerts which you have to quickly act upon,
that basically means that somewhere you have opened up a lot of ports within your security group through
which instance is exposed more than it should be or the Internet.
So these type of alerts are a way in which you can quickly take a proactive action.
Now, you can also go ahead and generate a sample alerts in case if you want to see what kind of things
that guard duty can detect.
So let's do one thing.
Let's take one example of another region where we look into how guard duty can be enabled and what are
the alerts.
So when you do a guard duty service on a new region, you'll get a console similar to this.
So let's click on Get Started and all you'll have to do is you'll have to enable the guard duty.
Now, as we were discussing, the guard duty basically meets the permission to analyze cloud logs,
VPC flow logs and DNS query logs to generate the security findings.
So let's go ahead and enable the guard duty over here.
And that's the only thing which is needed.
Now, guard duty will go ahead and analyze the logs within this specific region and it will generate
alerts accordingly.
Now, you can also go to the settings over here.
And there is an option of sample finding where you can go ahead and generate a sample finding.
So let's do that.
And now if you go to findings, you will see that there are a lot of findings which has been listed.
So again, the findings are categorized into high medium as well as the one which is low.
So I would really encourage you to go and look into these findings at a high level overview, because
this will allow you to detect on what kind of attacks guide you take and detect within your account.
Now, before we conclude that a certain important point is that we need to remember first one is that
a guard duty will only monitor Route 53 for the DNS logs.
This is very important here because what happens is that many organisations still make use of Active
Directory for the DNS and the logs from these servers will not be monitored.
So basically let's say that you have attacks like DNS Exfiltration which is associated with the Active
Directory, then guard duty will not really show you any alerts over here.
So this is one important part to remember.
Now this in fact, you can say that it is a shortcoming of guard duty and a lot of organizations who
are making use of custom DNS servers, they will not be able to see a lot of things over here.
So what many of the enterprises they do is they make use of commercial solutions like Splunk Enterprise
Security, which again is a great solution and it also has threat intelligence.
So when you use our commercial tools like Splunk or any others, the benefit is that you are not really
stuck with the limitations of a specific service.
So your if you're making use of Splunk or even any other tool, it can detect DNS exfiltration attacks
and other attacks, even if you're using the Active Directory DNS.
So that is one advantage.
Second advantage is that as we have seen, that guard duty does not take into account all the logs.
So it takes cloud, rail, VPC flow logs, DNS logs.
It does not take into account the logs associated with the AC two instance.
So it can be the audit logs, the wild logs, secure and others.
So there are limited logs in which the guard duty will try and perform the threat intelligence related
aspects into.
So I hope at a high level overview you understood what guard duty service is.
Now, again, even though guard duty does not monitor a lot of log files, but the log files that it
monitors, it does give you a lot of insights into the potential threats, because in a lot of organizations,
I have enabled guard duty and it does give you a huge amount of insights and you can quickly round up
into the server which would had been compromised.
Now, one of the disadvantages of commercial solutions are that they are very expensive and it also
takes a lot of time for it to be configured.
So guard duty as we have seen it just takes one click and it's all up for you.
So that's the overview about guard duty.
We look into the advantages, we look into the disadvantages of the service as well.
And again, I would really encourage you to go ahead and enable a guard duty within your organization.
And I'm sure that you will see a lot of interesting alerts in your accounts.
So with this will conclude this video, I hope this video has been informative for you and I look forward
to see you in the next video.