# AWS adds more than 50 optional GuardDuty runtime detection rules

_Published Monday, October 19, 2026 at 12:07 PM EDT · Security · Latest · Tier 2 — Notable_

Amazon says GuardDuty now lets customers enable more than 50 optional runtime detection rules for process, file and network activity. The rules target behavior that may be routine in one environment but signal compromise in another, including changes to sudoers files and disabling audit logging.

The detections cover EC2 instances, EKS and ECS on both EC2 and AWS Fargate. They span 13 finding types, including four new types addressing suspicious commands and sensitive-file reads. Customers can evaluate rules in dry-run mode before enabling live detection. The capability is available in all AWS commercial Regions and AWS GovCloud (US) Regions.

## Sources

- [Recent Announcements](https://aws.amazon.com/about-aws/whats-new/2026/10/guardduty-runtime-optional-detection-rules/)

---
Canonical: https://techandbusiness.org/newswire/SuWafv3r5L6joroR7LSA9B
Published: 2026-10-19T16:07:58.274Z
Story chronology: 2026-10-19T16:01:00.000Z
Retrieved: 2026-10-19T19:20:32.886Z
Publisher: Tech & Business (techandbusiness.org)