この日はセキュリティブログと新機能発表が各 1 件でした。セキュリティブログでは、Amazon GuardDuty Extended Threat Detection が Amazon EC2 と Amazon ECS を標的とする進行中の暗号通貨マイニングキャンペーンを検出したことが報告されました。この攻撃は 2025 年 11 月 2 日に始まり、侵害された IAM 認証情報を利用しており、GuardDuty が複数のシグナルを相関させて脅威を特定した事例です。新機能発表では、AWS IoT Device Management Commands が動的ペイロードに対応し、プレースホルダーを含む再利用可能なコマンドテンプレートの作成やパラメータ検証ルールが可能になりました。サーモスタットの温度設定など、異なる値で類似コマンドを送る IoT シナリオに有用です。
脅威検出: GuardDuty Extended Threat Detection が EC2/ECS 標的の暗号マイニングキャンペーンを検出 (侵害 IAM 認証情報を悪用)
IoT: AWS IoT Device Management Commands が動的ペイロード対応、再利用可能なコマンドテンプレートとパラメータ検証を提供
AWS IoT Device Management commands now supports dynamic payload functionality, enabling developers to create reusable command templates with placeholders that can be replaced with different values during command execution. The enhancement also includes parameter validation rules to verify that parameter values conform to specified criteria before execution. With this update, developers can now set parameters for the command during runtime, making it easier for them to re-use a command.
This feature is ideal for scenarios where you need to send similar commands with different parameter values to your Internet of Things (IoT) devices. For example, instead of creating separate commands to set different temperature values of a thermostat, you can now create one template with a temperature placeholder and specify the actual value during runtime. This template-based approach helps streamline command management for applications, such as adjusting device configurations or controlling smart home devices with variable settings.
AWS IoT Device Management commands with dynamic payload support is available in all AWS Regions where AWS IoT Device Management is currently available. To learn more about dynamic payloads and payload templates, visit AWS IoT Device Management Commands Developer Guide.
Amazon GuardDuty and our automated security monitoring systems identified an ongoing cryptocurrency (crypto) mining campaign beginning on November 2, 2025. The operation uses compromised AWS Identity and Access Management (IAM) credentials to target Amazon Elastic Container Service (Amazon ECS) and Amazon Elastic Compute Cloud (Amazon EC2). GuardDuty Extended Threat Detection was able to correlate signals […]