MELTr
Home Vendors Search Download
Login
Vendors / Amazon Web Services / AWS GuardDuty / GuardDuty Malware Protection for S3 Finding Type
Amazon Web Services logo

Event type

GuardDuty Malware Protection for S3 Finding Type

Malware detection on S3 objects

AWS GuardDuty Malware Protection for S3 finding type detecting malicious files in S3 objects during upload-triggered scans, including trojans, backdoors, viruses, ransomware, spyware, rootkits, miners, worms, and adware

JSON 14 fields Low Generator

malware-protection s3 malware-detection object-scanning
Preview Sample View Schema
CLI Install
meltr templates install aws

Overview

What this event covers

Malware Protection for S3 generates findings when malware scans detect malicious files in uploaded S3 objects. Requires both GuardDuty and Malware Protection for S3 to be enabled. Scans are triggered when objects are uploaded to protected buckets. Includes total number of detections and details for top 32 threats based on severity.

When generated

  • ›Malicious file detected in S3 object during upload-triggered scan
  • ›Object uploaded to protected S3 bucket contains malware
  • ›Malware scan detects threat in scanned S3 object
  • ›Scan triggered by S3 object upload event

Security relevance

High

Compliance

PCI-DSS 5.1.1, 11.4 HIPAA 164.308(a)(1), 164.312(e)(1) SOC 2 CC6.1, CC7.2 ISO 27001 A.12.4.1, A.12.4.2 NIST CSF PR.DS-5, DE.AE-3 CIS AWS Foundations 3.1-3.14

Frequency notes

Malware Protection for S3 findings are generated when uploaded objects contain malware. Frequency depends on upload volume and threat landscape. Production environments typically see 1-10 findings per day. Each finding represents one object scan with detected threats. Objects scanned before enabling GuardDuty won't generate findings - must re-upload object to scan. Default severity is High (8.0).

Resources

Docs and tools

Malware Protection for S3 Finding Type official Remediating Potentially Malicious S3 Object official GuardDuty Malware Protection for S3 official Enabling Malware Protection for S3 official AWS GuardDuty Console Web interface for viewing and managing S3 malware protection findings AWS S3 Console Manage S3 buckets and objects

Generation

Configuration

Base frequency
5 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.0x
Night hours
1.5x
Weekend
1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

detail.type
String Required

Malware Protection for S3 finding type (always Object:S3/MaliciousFile)

Source: Fixed value for S3 malware protection findings

Example Object:S3/MaliciousFile
Values
  • Object:S3/MaliciousFile Malicious file detected in scanned S3 object
detail.resource.s3BucketDetails
Array Required

Details about S3 bucket containing the malicious object

Source: S3 bucket metadata from GuardDuty

Example [{name, arn, type, owner, tags, publicAccess}]
detail.service.malwareProtectionScanDetails.scannedResourceDetails.bucketArn
String Required

ARN of the S3 bucket containing the scanned object

Source: S3 bucket ARN from scan details

Format S3 bucket ARN
Example arn:aws:s3:::data-bucket-123456
detail.service.malwareProtectionScanDetails.scannedResourceDetails.objectKey
String Required

S3 object key (path) of the scanned object containing malware. Note: Object keys may be controlled by malicious actors and should be sanitized when displayed

Source: S3 object key from scan details

Format S3 object key (path)
Example uploads/malware.exe
detail.service.malwareProtectionScanDetails.scannedResourceDetails.objectVersionId
String Optional

Version ID of the S3 object (if versioning is enabled)

Source: S3 object version ID or null

Format S3 object version ID or 'null'
Example null
detail.service.malwareProtectionScanDetails.scanId
String Required

Unique identifier for the malware scan

Source: random_guid()

Format UUID
Example 550e8400-e29b-41d4-a716-446655440000
detail.service.malwareProtectionScanDetails.triggerFindingId
String Optional

GuardDuty finding ID that triggered this scan (if scan was triggered by finding)

Source: random_hex(32, 32) or empty if upload-triggered

Format 32-character hexadecimal string
Example a1b2c3d4e5f6...
detail.service.malwareProtectionScanDetails.sources
Array Required

Source that initiated the scan

Source: random_choice(['THREAT_DETECTION', 'SCHEDULED_SCAN', 'ON_DEMAND'])

Example ['THREAT_DETECTION']
Values
  • THREAT_DETECTION Scan triggered by GuardDuty threat detection finding
  • SCHEDULED_SCAN Scan performed on scheduled basis
  • ON_DEMAND Scan triggered by object upload to protected bucket
detail.service.additionalInfo.threatsDetectedItemCount
Integer Required

Total number of threats detected during the scan

Source: random_int(1, 32) - total detections in scan

Format Integer (1 or more)
Example 3
detail.service.additionalInfo.threatsDetected
Array Required

Details for top 32 threats detected (based on severity). Each finding includes up to 32 threats.

Source: Array of threat details from malware scan

Example [{threatName, severity, itemCount, files}]
detail.service.additionalInfo.threatsDetected[].threatName
String Required

Name of the detected threat

Source: random_choice() of malware threat names

Format Threat name
Example Trojan.Win32.Generic
Values
  • Trojan.Win32.Generic Windows trojan
  • Trojan.Linux.Generic Linux trojan
  • Backdoor.Linux.Generic Linux backdoor
  • Virus.Win32.Generic Windows virus
  • Ransomware.Win32.Generic Windows ransomware
  • Spyware.Win32.Generic Windows spyware
  • Rootkit.Linux.Generic Linux rootkit
  • Miner.Linux.Generic Cryptocurrency miner
  • Worm.Win32.Generic Windows worm
  • Adware.Mac.Generic Mac adware
detail.service.additionalInfo.threatsDetected[].files[].filePath
String Required

S3 object key or path within object to the malicious file. Note: File paths may be controlled by malicious actors and should be sanitized when displayed

Source: File path from malware scan

Format S3 object key or internal file path
Example uploads/malware.exe
detail.service.additionalInfo.threatsDetected[].files[].fileHash
String Required

SHA-256 hash of the malicious file

Source: SHA-256 hash of file content

Format 64-character hexadecimal string
Example a1b2c3d4e5f6...
detail.severity
Integer Required

Finding severity level (default is High/8.0 for S3 malware findings)

Source: random_choice([5, 8, 8, 8]) - default is High

Example 8
Values
  • 5 Medium severity (4.0-6.9)
  • 8 High severity (7.0-8.9) - default for S3 malware findings