implementing-cloud-workload-protection

What problem does it solve?

Cloud compute workloads are frequent targets for cryptominers, reverse shells, and unauthorized binaries, but detecting these runtime threats requires continuous process, network, and file integrity monitoring that is tedious to build manually.

Core Features & Use Cases

• Process Monitoring: Runs remote commands via AWS Systems Manager to detect cryptominers (xmrig, minerd) and reverse shells on EC2 instances.
• Network & File Integrity Auditing: Checks outbound connections for C2 callbacks and compares binary hashes against known-good baselines.
• Anomaly Detection Guidance: Covers CPU spike detection, baseline capture, and common misconfigurations like unmanaged SSM agents and unchecked command results.
• Use Case: A security engineer needs to verify that a fleet of EC2 instances has not been compromised by cryptomining malware; this Skill provides the boto3/SSM commands and verification steps to scan and confirm findings.

Quick Start

Ask the AI to write a boto3 script that uses AWS Systems Manager to scan my EC2 instances for cryptomining processes and suspicious outbound connections.