prowler-cloud 5.14.1__py3-none-any.whl → 5.15.0__py3-none-any.whl

prowler/providers/alibabacloud/services/sls/sls_vpc_network_route_changes_alert_enabled/sls_vpc_network_route_changes_alert_enabled.py

@@ -0,0 +1,52 @@
+from prowler.lib.check.models import Check, CheckReportAlibabaCloud
+from prowler.providers.alibabacloud.services.sls.sls_client import sls_client
+
+
+class sls_vpc_network_route_changes_alert_enabled(Check):
+    def execute(self) -> list[CheckReportAlibabaCloud]:
+        findings = []
+        found = False
+
+        for alert in sls_client.alerts:
+            query_list = alert.configuration.get("queryList", [])
+            if not query_list:
+                continue
+
+            for query_obj in query_list:
+                query = query_obj.get("query", "")
+                if ("Ecs" in query or "Vpc" in query) and (
+                    "CreateRouteEntry" in query
+                    or "DeleteRouteEntry" in query
+                    or "ModifyRouteEntry" in query
+                    or "AssociateRouteTable" in query
+                    or "UnassociateRouteTable" in query
+                ):
+                    found = True
+                    report = CheckReportAlibabaCloud(
+                        metadata=self.metadata(), resource=alert
+                    )
+                    report.status = "PASS"
+                    report.status_extended = f"SLS Alert {alert.name} is configured for VPC network route changes."
+                    report.resource_id = alert.name
+                    report.resource_arn = alert.arn
+                    report.region = alert.region
+                    findings.append(report)
+                    break
+
+            if found:
+                break
+
+        if not found:
+            report = CheckReportAlibabaCloud(
+                metadata=self.metadata(), resource=sls_client.provider.identity
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                "No SLS Alert configured for VPC network route changes."
+            )
+            report.resource_id = sls_client.audited_account
+            report.resource_arn = sls_client.provider.identity.identity_arn
+            report.region = sls_client.region
+            findings.append(report)
+
+        return findings

prowler/providers/alibabacloud/services/vpc/vpc_client.py

@@ -0,0 +1,4 @@
+from prowler.providers.alibabacloud.services.vpc.vpc_service import VPC
+from prowler.providers.common.provider import Provider
+
+vpc_client = VPC(Provider.get_global_provider())

prowler/providers/alibabacloud/services/vpc/vpc_flow_logs_enabled/vpc_flow_logs_enabled.metadata.json

@@ -0,0 +1,39 @@
+{
+  "Provider": "alibabacloud",
+  "CheckID": "vpc_flow_logs_enabled",
+  "CheckTitle": "VPC flow logging is enabled in all VPCs",
+  "CheckType": [
+    "Suspicious network connection",
+    "Cloud threat detection"
+  ],
+  "ServiceName": "vpc",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "acs:vpc:region:account-id:vpc/{vpc-id}",
+  "Severity": "medium",
+  "ResourceType": "AlibabaCloudVPC",
+  "Description": "You can use the **flow log function** to monitor the IP traffic information for an ENI, a VSwitch, or a VPC.\n\nIf you create a flow log for a VSwitch or a VPC, all the **Elastic Network Interfaces**, including the newly created ones, are monitored. Such flow log data is stored in **Log Service**, where you can view and analyze IP traffic information. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.",
+  "Risk": "**VPC Flow Logs** provide visibility into network traffic that traverses the VPC and can be used to detect **anomalous traffic** or provide insight during security workflows.\n\nWithout flow logs, it is difficult to investigate network-based security incidents.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.alibabacloud.com/help/doc-detail/90628.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-VPC/enable-flow-logs.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aliyun vpc CreateFlowLog --ResourceId <vpc_id> --ResourceType VPC --FlowLogName <flow_log_name> --LogStoreName <log_store_name> --ProjectName <project_name>",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": "resource \"alicloud_vpc_flow_log\" \"example\" {\n  flow_log_name  = \"example-flow-log\"\n  resource_type  = \"VPC\"\n  resource_id    = alicloud_vpc.example.id\n  traffic_type   = \"All\"\n  project_name   = alicloud_log_project.example.project_name\n  log_store_name = alicloud_log_store.example.logstore_name\n}"
+    },
+    "Recommendation": {
+      "Text": "1. Log on to the **VPC Console**\n2. In the left-side navigation pane, click **FlowLog**\n3. Follow the instructions to create FlowLog for each of your VPCs",
+      "Url": "https://hub.prowler.com/check/vpc_flow_logs_enabled"
+    }
+  },
+  "Categories": [
+    "logging"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/alibabacloud/services/vpc/vpc_flow_logs_enabled/vpc_flow_logs_enabled.py

@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, CheckReportAlibabaCloud
+from prowler.providers.alibabacloud.services.vpc.vpc_client import vpc_client
+
+
+class vpc_flow_logs_enabled(Check):
+    """Check if VPC flow logging is enabled in all VPCs."""
+
+    def execute(self) -> list[CheckReportAlibabaCloud]:
+        findings = []
+
+        for vpc in vpc_client.vpcs.values():
+            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=vpc)
+            report.region = vpc.region
+            report.resource_id = vpc.id
+            report.resource_arn = (
+                f"acs:vpc:{vpc.region}:{vpc_client.audited_account}:vpc/{vpc.id}"
+            )
+
+            if vpc.flow_log_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"VPC {vpc.name if vpc.name else vpc.id} has flow logs enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} does not have flow logs enabled."
+
+            findings.append(report)
+
+        return findings

prowler/providers/alibabacloud/services/vpc/vpc_service.py

@@ -0,0 +1,102 @@
+from datetime import datetime
+from typing import Optional
+
+from alibabacloud_vpc20160428 import models as vpc_models
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
+from prowler.providers.alibabacloud.lib.service.service import AlibabaCloudService
+
+
+class VPC(AlibabaCloudService):
+    """
+    VPC (Virtual Private Cloud) service class for Alibaba Cloud.
+
+    This class provides methods to interact with Alibaba Cloud VPC service
+    to retrieve VPCs, flow logs, etc.
+    """
+
+    def __init__(self, provider):
+        # Call AlibabaCloudService's __init__
+        super().__init__(__class__.__name__, provider, global_service=False)
+
+        # Fetch VPC resources
+        self.vpcs = {}
+        self.__threading_call__(self._describe_vpcs)
+        self._describe_flow_logs()
+
+    def _describe_vpcs(self, regional_client):
+        """List all VPCs in the region."""
+        region = getattr(regional_client, "region", "unknown")
+        logger.info(f"VPC - Describing VPCs in {region}...")
+
+        try:
+            request = vpc_models.DescribeVpcsRequest()
+            response = regional_client.describe_vpcs(request)
+
+            if response and response.body and response.body.vpcs:
+                for vpc_data in response.body.vpcs.vpc:
+                    if not self.audit_resources or is_resource_filtered(
+                        vpc_data.vpc_id, self.audit_resources
+                    ):
+                        vpc_id = vpc_data.vpc_id
+                        self.vpcs[vpc_id] = VPCs(
+                            id=vpc_id,
+                            name=getattr(vpc_data, "vpc_name", vpc_id),
+                            region=region,
+                            cidr_block=getattr(vpc_data, "cidr_block", ""),
+                            description=getattr(vpc_data, "description", ""),
+                            create_time=getattr(vpc_data, "creation_time", None),
+                            is_default=getattr(vpc_data, "is_default", False),
+                            flow_log_enabled=False,  # Will be updated in _describe_flow_logs
+                        )
+
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _describe_flow_logs(self):
+        """Get flow logs for all VPCs."""
+        logger.info("VPC - Describing Flow Logs...")
+
+        for vpc_id, vpc in self.vpcs.items():
+            try:
+                regional_client = self.regional_clients.get(vpc.region)
+                if not regional_client:
+                    continue
+
+                request = vpc_models.DescribeFlowLogsRequest()
+                request.resource_id = vpc_id
+                request.resource_type = "VPC"
+                response = regional_client.describe_flow_logs(request)
+
+                if response and response.body and response.body.flow_logs:
+                    flow_logs = response.body.flow_logs.flow_log
+                    if flow_logs:
+                        # Check if any flow log is active
+                        for flow_log in flow_logs:
+                            status = getattr(flow_log, "status", "")
+                            if status == "Active":
+                                vpc.flow_log_enabled = True
+                                break
+
+            except Exception as error:
+                logger.error(
+                    f"{vpc.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+
+# Models for VPC service
+class VPCs(BaseModel):
+    """VPC model."""
+
+    id: str
+    name: str
+    region: str
+    cidr_block: str
+    description: str = ""
+    create_time: Optional[datetime] = None
+    is_default: bool = False
+    flow_log_enabled: bool = False

prowler/providers/aws/aws_regions_by_service.json

@@ -761,11 +761,15 @@
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
+          "ap-southeast-5",
           "ca-central-1",
           "eu-central-1",
+          "eu-south-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "il-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -1379,6 +1383,7 @@
     "bedrock": {
       "regions": {
         "aws": [
+          "af-south-1",
           "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
@@ -1392,6 +1397,7 @@
           "ap-southeast-5",
           "ap-southeast-7",
           "ca-central-1",
+          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -1402,6 +1408,8 @@
           "eu-west-3",
           "il-central-1",
           "me-central-1",
+          "me-south-1",
+          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -1418,6 +1426,7 @@
     "bedrock-agent": {
       "regions": {
         "aws": [
+          "af-south-1",
           "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
@@ -1431,6 +1440,7 @@
           "ap-southeast-5",
           "ap-southeast-7",
           "ca-central-1",
+          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -1441,6 +1451,8 @@
           "eu-west-3",
           "il-central-1",
           "me-central-1",
+          "me-south-1",
+          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -3595,6 +3607,7 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
+          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -5551,6 +5564,7 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
+          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -8459,6 +8473,7 @@
           "ap-southeast-3",
           "ap-southeast-4",
           "ap-southeast-5",
+          "ap-southeast-6",
           "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
@@ -10696,7 +10711,9 @@
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
+          "ap-southeast-5",
           "ca-central-1",
+          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -10732,7 +10749,9 @@
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
+          "ap-southeast-5",
           "ca-central-1",
+          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
@@ -11239,6 +11258,7 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
+          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",

prowler/providers/aws/services/apigateway/apigateway_restapi_waf_acl_attached/apigateway_restapi_waf_acl_attached.metadata.json

@@ -29,9 +29,7 @@
       "Url": "https://hub.prowler.com/check/apigateway_restapi_waf_acl_attached"
     }
   },
-  "Categories": [
-    "threat-detection"
-  ],
+  "Categories": [],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "",

prowler/providers/aws/services/cloudtrail/cloudtrail_insights_exist/cloudtrail_insights_exist.metadata.json

@@ -33,7 +33,7 @@
     }
   },
   "Categories": [
-    "threat-detection"
+    "forensics-ready"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json

@@ -34,8 +34,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.metadata.json

@@ -35,8 +35,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json

@@ -32,8 +32,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.metadata.json

@@ -29,8 +29,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.metadata.json

@@ -31,8 +31,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.metadata.json

@@ -33,8 +33,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.metadata.json

@@ -36,8 +36,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.metadata.json

@@ -34,8 +34,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json

@@ -32,8 +32,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json

@@ -32,8 +32,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_root_usage/cloudwatch_log_metric_filter_root_usage.metadata.json

@@ -38,8 +38,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.metadata.json

@@ -33,8 +33,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json

@@ -37,8 +37,7 @@
     }
   },
   "Categories": [
-    "logging",
-    "threat-detection"
+    "logging"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_unauthorized_api_calls/cloudwatch_log_metric_filter_unauthorized_api_calls.metadata.json

@@ -36,7 +36,6 @@
     }
   },
   "Categories": [
-    "threat-detection",
     "logging"
   ],
   "DependsOn": [],

prowler/providers/aws/services/guardduty/guardduty_centrally_managed/guardduty_centrally_managed.metadata.json

@@ -1,26 +1,32 @@
 {
   "Provider": "aws",
   "CheckID": "guardduty_centrally_managed",
-  "CheckTitle": "GuardDuty is centrally managed",
-  "CheckType": [],
+  "CheckTitle": "GuardDuty detector is managed by an administrator account or is the administrator with member accounts",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
   "ServiceName": "guardduty",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:guardduty:region:account-id/detector-id",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
   "ResourceType": "AwsGuardDutyDetector",
-  "Description": "GuardDuty is centrally managed",
-  "Risk": "If GuardDuty is not centrally managed, it is not possible to centrally manage the GuardDuty findings, settings, and member accounts.",
-  "RelatedUrl": "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html",
+  "Description": "Amazon GuardDuty detectors are under **centralized management** when linked to a delegated administrator account, or when the detector's account serves as the **administrator** with associated member accounts.",
+  "Risk": "Lack of central management fragments **visibility** and slows **incident response** across accounts and regions. Adversaries can persist unnoticed, perform **lateral movement**, exfiltrate data, and alter configurations, harming **confidentiality**, **integrity**, and **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "",
+      "CLI": "aws guardduty enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID>",
       "NativeIaC": "",
-      "Other": "",
+      "Other": "1. Sign in to the AWS Organizations management account\n2. Open the AWS Organizations console\n3. Go to Services > Amazon GuardDuty\n4. Click Register delegated administrator\n5. Enter the admin account ID and click Register",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Configure GuardDuty to be centrally managed",
-      "Url": "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html"
+      "Text": "Designate a **delegated administrator** (preferably via *AWS Organizations*) and enroll all accounts as **members**. Enable auto-enrollment for new accounts, standardize detector settings across required regions, and route findings to central monitoring. Apply **least privilege** and **separation of duties**.",
+      "Url": "https://hub.prowler.com/check/guardduty_centrally_managed"
     }
   },
   "Categories": [],

prowler/providers/aws/services/guardduty/guardduty_ec2_malware_protection_enabled/guardduty_ec2_malware_protection_enabled.metadata.json

@@ -1,32 +1,41 @@
 {
   "Provider": "aws",
   "CheckID": "guardduty_ec2_malware_protection_enabled",
-  "CheckTitle": "Ensure that GuardDuty Malware Protection for EC2 is enabled.",
+  "CheckTitle": "GuardDuty detector has Malware Protection for EC2 enabled",
   "CheckType": [
-    "Software and Configuration Checks/AWS Security Best Practices"
+    "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "guardduty",
   "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:guardduty:region:account-id/detector-id",
+  "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AwsGuardDutyDetector",
-  "Description": "GuardDuty Malware Protection for EC2 helps you detect the potential presence of malware by scanning the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances and container workloads.",
-  "Risk": "Malware can compromise your EC2 instances and container workloads, leading to data breaches, data exfiltration, and other security incidents.",
-  "RelatedUrl": "https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html",
+  "Description": "**GuardDuty detectors** with **Malware Protection for EC2** enabled perform agentless scans of EBS volumes attached to **EC2 instances** and container workloads. Scans can be triggered by suspicious activity or run on-demand to identify malicious files within restored volume snapshots.",
+  "Risk": "Absent this coverage, malware on EC2 or containers can remain **undetected**, enabling:\n- Confidentiality loss via data exfiltration/credential theft\n- Integrity compromise through tampering and backdoors\n- Availability impact from ransomware/cryptominers\n\nPersistence increases **lateral movement** across the environment.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.infoq.com/news/2022/08/aws-guardduty-malware-detection/",
+    "https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/GuardDuty/enable-malware-protection-for-ec2.html",
+    "https://medium.com/@shashank.kulkarni0708/get-juiced-how-i-hacked-owasp-juice-shop-and-let-guardduty-catch-me-537f7064a1d5",
+    "https://docs.aws.amazon.com/guardduty/latest/ug/configure-malware-protection-single-account.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html#guardduty-8"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "aws guardduty update-detector --detector-id <detector-id> --data-sources MalwareProtection={ScanEc2InstanceWithFindings={EbsVolumes=true}}",
-      "NativeIaC": "",
-      "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html#guardduty-8",
-      "Terraform": ""
+      "CLI": "aws guardduty update-detector --detector-id <detector-id> --features '[{\"Name\":\"EBS_MALWARE_PROTECTION\",\"Status\":\"ENABLED\"}]'",
+      "NativeIaC": "```yaml\n# CloudFormation: enable GuardDuty Malware Protection for EC2\nResources:\n  GuardDutyDetector:\n    Type: AWS::GuardDuty::Detector\n    Properties:\n      Enable: true\n      Features:\n        - Name: EBS_MALWARE_PROTECTION  # Critical: selects EC2 Malware Protection feature\n          Status: ENABLED               # Critical: enables the feature\n```",
+      "Other": "1. In the AWS console, open GuardDuty\n2. In the left menu, select Protection plans > Malware Protection for EC2\n3. Click Enable, then Save",
+      "Terraform": "```hcl\n# Enable GuardDuty Malware Protection for EC2\nresource \"aws_guardduty_detector\" \"<example_resource_name>\" {\n  enable = true\n\n  features {\n    name   = \"EBS_MALWARE_PROTECTION\"  # Critical: selects EC2 Malware Protection feature\n    status = \"ENABLED\"                  # Critical: enables the feature\n  }\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable Malware Protection for EC2 in GuardDuty.",
-      "Url": "https://docs.aws.amazon.com/guardduty/latest/ug/configure-malware-protection-single-account.html"
+      "Text": "Enable **Malware Protection for EC2** across all accounts and Regions under centralized administration. Apply **least privilege** to findings access, define scan scope with tags and minimize exclusions, and retain snapshots based on data sensitivity. Integrate alerts with IR/SIEM and pair with hardening and vulnerability scanning for **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/guardduty_ec2_malware_protection_enabled"
     }
   },
   "Categories": [],
-  "Notes": "",
   "DependsOn": [],
-  "RelatedTo": []
+  "RelatedTo": [],
+  "Notes": ""
 }