r5.4 Automated response to malware detection
Automate isolation and response to malware detections to minimize exposure time and demonstrate timely handling of threats.
AWS services
Amazon GuardDuty 
Amazon EventBridge 
AWS Lambda 
AWS Step Functions Requirement 5
Protect All Systems and Networks from Malicious Software
PCI sub-requirements covered
- 5.2 Malicious software is prevented, or detected and addressed
- 5.3 Anti-malware mechanisms and processes are active, maintained, and monitored
How to implement on AWS
Define playbooks that, on GuardDuty Malware Protection findings, isolate the instance (quarantine security group), take forensic snapshots, and notify. Orchestrate with EventBridge + Lambda or Step Functions. Log every action for evidence.
Practical implementation
How this control is implemented in each reference architecture:
On a GuardDuty malware finding, trigger an EventBridge rule + Lambda that isolates the instance with a quarantine security group, snapshots it for forensics, and notifies the team.
Single-account, 3-tier →Centralize the malware response playbook (EventBridge/Lambda/Step Functions) driven by the org-wide GuardDuty stream, with a cross-account role that lets the security account isolate a compromised instance in any CDE account.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine anti-malware configurations and logs/scan results to verify the solution is active and detects/addresses malware, and that logs are retained per Requirement 10.5.1 (5.3.2.c, 5.3.4).
Evidence in AWS
- Definition of malware response playbooks (EventBridge/Lambda/Step Functions).
- Execution history of isolation and notification on findings.
- Forensic snapshots and records of the actions taken.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 5.2 — Automated mechanisms are implemented to prevent systems from becoming an attack vector for malware.
- 5.3 — Anti-malware mechanisms can detect and address the latest malware threats.
Learning resources
References
- AWS Security Maturity Model: Automate response to findings