Demonstrating AWS GuardDuty EC2 Runtime Monitoring with a Reverse-Shell Lab
· 15:43 · Watch on YouTube ↗
Summary
A tutorial demonstrates GuardDuty runtime monitoring on EC2 by simulating PHP command injection and a reverse shell, then reviewing findings, process lineage, instance coverage, and automated agent configuration.
Key points
- The presenter uses a lab web page with PHP command injection to run commands on a monitored EC2 instance.
- The demonstration creates and hosts a Linux reverse-shell payload, which the target downloads and executes.
- GuardDuty reports the reverse shell and suspicious curl activity, with executable paths and process lineage linking activity to PHP.
- The presenter notes that GuardDuty findings can help investigate a possible security event and consider containing the EC2 instance.
- The tutorial checks runtime-monitoring coverage and agent status, and shows delegated-administrator settings for enabling automated EC2 agent installation.
Article Details
- Topics
- [00:00] GuardDuty runtime monitoring and EC2 lab setup
- [02:23] PHP command-injection test page and target instance
- [05:13] Creating and hosting a reverse-shell payload
- [07:18] Downloading and executing the payload to establish a reverse shell
- [10:14] Reviewing GuardDuty findings, executable paths, and process lineage
- [12:51] Checking runtime coverage and configuring automatic agent installation
MITRE ATT&CK
T1059.004 · Unix ShellThe demonstration executes shell commands on the target, including running the downloaded Linux payload.T1105 · Ingress Tool TransferThe target uses curl to download the reverse-shell payload hosted by the lab machine.T1190 · Exploit Public-Facing ApplicationThe lab uses operating-system command injection through a PHP web page to run commands on the EC2 target.