Why did I receive a GuardDuty CryptoCurrency:EC2/BitcoinTool.B!DNS finding type for my Amazon EC2 instance?

Resolution

The GuardDuty CryptoCurrency:EC2/BitcoinTool.B!DNS finding type shows that an Amazon EC2 instance in your AWS environment is querying a domain name. The domain name is associated with cryptocurrency-related activity such as Bitcoin mining.

If you use your Amazon EC2 instance with cryptocurrency or with blockchain activity, then this finding type might be expected activity for your environment. It's a best practice to set up a suppression rule for this finding type. For more information and instructions, see CryptoCurrency:EC2/BitcoinTool.B!DNS.

If you don't expect this behavior, then it might be a result of unauthorized activity on your AWS account. Follow these instructions to remediate a compromised Amazon EC2 instance in your AWS environment.

For more information, see GuardDuty foundational data sources.

Related information

Creating custom responses to GuardDuty findings with Amazon CloudWatch Events

How to use Amazon GuardDuty and AWS Web Application Firewall to automatically block suspicious hosts