GuardDuty reports 'CryptoCurrency:EC2/BitcoinTool.B!DNS' on an instance. What does this finding mean?
A.The instance hosts a blockchain app by design
Unless you run a mining pool, it's malicious by definition.
B.The instance is likely compromised — it's querying DNS for crypto-mining pools
Correct. Mining-pool DNS = compromised compute.
C.A routine software update
Updates don't contact mining pools.
D.A billing anomaly
The cost comes later — the finding is the intrusion.
Why this answer
The CryptoCurrency finding family detects DNS/communication with known mining pools — a strong compromise indicator (attackers monetize compute). Response: isolate the instance, check for persistence, rotate credentials on it.
Correct answer: B · Last reviewed 2026-11-04
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response