A container platform team notices a shell process spawned inside a running pod that opened an outbound connection to an unknown host, which is typical of an attacker gaining interactive access. Which threat detection capability watches process and file behavior inside running workloads to catch this?
Show answer and explanation
Answer: C
GuardDuty Runtime Monitoring installs an agent in EKS, ECS, and EC2 workloads that observes process, file, and network behavior at runtime. It detects activity that only appears while a container runs, such as reverse shells, crypto mining, or suspicious process execution. S3 Protection and Lambda Protection look at other data sources, and Inspector scans images for vulnerabilities without seeing behavior at runtime.
Why the other options are wrong
- A. S3 Protection analyzes object-level data events for suspicious access to buckets. It does not observe processes or shells running inside a pod.
- B. Lambda Protection watches function invocations for suspicious network activity. It does not cover containers in an EKS cluster, so a pod shell would be outside its scope.
- D. Inspector image scanning finds known package vulnerabilities before deployment. It cannot show a live process starting in a running pod, which is a runtime event.