| Your decision | Amazon GuardDuty | Elastio |
|---|---|---|
| Investigate a compromise | GuardDuty analyzes AWS events and threat signals. Investigation, currently in preview, adds AI analysis, supporting evidence, confidence, and recommended actions.[1][2] | Pursuit’s AI agents examine supported EC2 system snapshots and AMIs, following persistence mechanisms through code and system records to a supported finding. |
| Inspect recovery copies | Malware Protection for AWS Backup examines supported EBS snapshots, EC2 AMIs, and S3 recovery points. AWS Backup also documents malware-aware recovery-point selection.[3][4] | Hunt examines supported AWS data and copies for ransomware damage, malware, and corruption. Review the affected files and completed checks when choosing a recovery candidate. |
| Act on the evidence | GuardDuty publishes findings into AWS security workflows. Its Investigation preview includes recommended actions and CLI commands.[1][2] | Pursuit connects the finding to related-system investigations and a source-specific response plan. Your team executes the actions; Pursuit investigates new copies after remediation. |
Elastio and Amazon GuardDuty
Investigate what is inside your AWS systems.
Use EC2 system snapshots and AMIs to investigate attacker footholds, understand the mechanism, and guide response. Pursuit examines supported copies outside the host. Hunt analyzes AWS data and recovery copies for ransomware damage, malware, and corruption.
Security decisions / Supported by evidence
Bring system evidence into every AWS security decision.
Bring the image or snapshot into the investigation itself. Pursuit follows the files, code, and system records inside it, including images that are not running. The resulting evidence supports image release, containment, and recovery decisions.
Recorded Pursuit investigation / PacketBuffer
A startup script. A recurring secret-capture chain.
The recorded investigation links a persistent startup mechanism to code that captures TLS session secrets and writes them to a remote share.
- 01 / Persistence
Identify persistence.
Machine Group Policy Startup invokes
packet_buffer.ps1. - 02 / Code
Explain the behavior.
The script launches Frida with
tls.jsagainstlsass.exeto capture TLS secrets. - 03 / Corroboration
Connect the records.
A hidden scheduled job and Sysmon records support repeated execution of the chain.
Recorded findings F-001 and F-002. Historical execution is documented; the record does not establish current activity or a completed remediation.
Open the recorded investigation →Investigation → Response → Recovery
Put the finding to work.
Pursuit turns findings into a guided response plan. It investigates related systems, adapts the plan as results arrive, and examines replacement images and systems.
Your team reviews and executes containment, rebuild, and restore steps. Hunt’s analysis of the data and available copies informs the recovery decision.
A product demonstration of the evidence, response plan, and follow-up investigation.
Sources and scope · Reviewed October 10, 2026
- AWS: GuardDuty capabilities
- AWS: GuardDuty Investigation preview
- AWS: backup malware protection
- AWS Backup: malware protection and recovery points
Availability varies by product, edition, source, and deployment. The recorded case demonstrates Elastio’s investigation; it is not a head-to-head detection test.