Question

A security team enables GuardDuty Malware Protection for EC2. GuardDuty generates an 'Execution:EC2/MaliciousFile' finding after scanning an EBS volume attached to a production instance and detecting a trojan. The team wants an automated, least-disruptive first response that preserves the ability to investigate while preventing the malware from spreading laterally, and they must ensure the finding and any related activity remain fully investigable afterward. Which approach best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the finding that invokes a Lambda function to replace the instance's security groups with an isolation security group that denies all traffic, tag the instance for forensics, and create Detective and investigation entries before analysts examine it.

Answer

Configure an EventBridge rule to invoke a Lambda function that immediately terminates the affected EC2 instance to stop the malware from executing further.

Answer

Create a Security Hub suppression rule for the 'Execution:EC2/MaliciousFile' finding type so the alert stops recurring, then patch the instance during the next maintenance window.

Answer

Use Systems Manager Run Command to run an antivirus removal script on the instance automatically, delete the infected files, and leave the instance in service.