A. An adversary has compromised an AWS resource so that the resource is capable of contacting its home command and control (C&C) server to receive further instructions for malicious activity.
B. GuardDuty is detecting activity or activity patterns that are different from the established baseline for a particular AWS resource.
C. GuardDuty is detecting activity or activity patterns that suggest that an adversary is attempting to manipulate, interrupt, or destroy the company’s systems and data.
D. GuardDuty is detecting activity or activity patterns that an adversary might use to expand its knowledge of the company’s systems and internal networks.