Back to Checks
aws

GuardDuty detector has Malware Protection for EC2 enabled

guardduty_ec2_malware_protection_enabled
Service: guarddutySeverity: high
OfficialBuilt-inVerified
Resource Type:AwsGuardDutyDetector

GuardDuty detectors with Malware Protection for EC2 enabled perform agentless scans of EBS volumes attached to EC2 instances and container workloads. Scans can be triggered by suspicious activity or run on-demand to identify malicious files within restored volume snapshots.

Prowler logoProwlerprowler-provider-aws

Risk

Absent this coverage, malware on EC2 or containers can remain undetected, enabling:

  • Confidentiality loss via data exfiltration/credential theft
  • Integrity compromise through tampering and backdoors
  • Availability impact from ransomware/cryptominers

Persistence increases lateral movement across the environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks guardduty_ec2_malware_protection_enabled

Recommendation

Enable Malware Protection for EC2 across all accounts and Regions under centralized administration. Apply least privilege to findings access, define scan scope with tags and minimize exclusions, and retain snapshots based on data sensitivity. Integrate alerts with IR/SIEM and pair with hardening and vulnerability scanning for defense in depth.

Remediation

CLI

aws guardduty update-detector --detector-id <detector-id> --features '[{"Name":"EBS_MALWARE_PROTECTION","Status":"ENABLED"}]'

Terraform

# Enable GuardDuty Malware Protection for EC2
resource "aws_guardduty_detector" "<example_resource_name>" {
  enable = true

  features {
    name   = "EBS_MALWARE_PROTECTION"  # Critical: selects EC2 Malware Protection feature
    status = "ENABLED"                  # Critical: enables the feature
  }
}

NativeIaC

# CloudFormation: enable GuardDuty Malware Protection for EC2
Resources:
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      Features:
        - Name: EBS_MALWARE_PROTECTION  # Critical: selects EC2 Malware Protection feature
          Status: ENABLED               # Critical: enables the feature

Other

1In the AWS console, open GuardDuty
2In the left menu, select Protection plans > Malware Protection for EC2
3Click Enable, then Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.guardduty.guardduty_client import guardduty_client


class guardduty_ec2_malware_protection_enabled(Check):
    def execute(self):
        findings = []
        for detector in guardduty_client.detectors:
            if detector.status:
                report = Check_Report_AWS(metadata=self.metadata(), resource=detector)
                report.status = "FAIL"
                report.status_extended = f"GuardDuty detector {detector.id} does not have Malware Protection for EC2 enabled."
                if detector.ec2_malware_protection:
                    report.status = "PASS"
                    report.status_extended = f"GuardDuty detector {detector.id} has Malware Protection for EC2 enabled."
                findings.append(report)
        return findings

References