AWS GuardDuty Detection Suppression

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies attempts to suppress or blind Amazon GuardDuty without deleting the detector outright. Adversaries with
 11GuardDuty permissions can create or update a trusted IP set (CreateIPSet/UpdateIPSet) so that traffic from listed
 12addresses is never flagged, tamper with the threat intelligence feed used to generate findings
 13(CreateThreatIntelSet/UpdateThreatIntelSet), or soft-disable the detector via UpdateDetector with Enable set to
 14false. All three techniques leave the detector itself intact, evading detections that only look for detector deletion.
 15"""
 16false_positives = [
 17    """
 18    Security teams may legitimately register trusted IP ranges (VPNs, scanners, NAT gateways) or update threat
 19    intelligence feeds as part of normal GuardDuty tuning. Verify whether the user identity, user agent, and/or hostname
 20    should be making changes to GuardDuty configuration. If known behavior is causing false positives, it can be
 21    exempted from the rule.
 22    """,
 23]
 24from = "now-6m"
 25index = ["logs-aws.cloudtrail-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "AWS GuardDuty Detection Suppression"
 29note = """## Triage and analysis
 30
 31### Investigating AWS GuardDuty Detection Suppression
 32
 33Amazon GuardDuty relies on its detector configuration, trusted IP list, and threat intelligence feeds to decide which
 34activity generates findings. An adversary who cannot (or does not want to) delete the detector outright can instead
 35blind it in place:
 36
 37- **`CreateIPSet`/`UpdateIPSet`** (activated): traffic from any address in the list is treated as trusted and will
 38  not generate findings, even if it originates from the adversary's own infrastructure.
 39- **`CreateThreatIntelSet`/`UpdateThreatIntelSet`** (activated): replaces or extends the indicators GuardDuty uses to
 40  flag known-malicious activity; an adversary who controls this feed controls what GuardDuty considers malicious.
 41- **`UpdateDetector`** with `Enable: false`: disables the detector without deleting it, leaving its configuration and
 42  historical findings intact while stopping all new analysis — quieter than `DeleteDetector`, which has its own
 43  dedicated detection.
 44
 45### Possible investigation steps
 46
 47- **Identify the actor**: review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to
 48  determine who made the change, and whether this principal normally performs GuardDuty administration.
 49- **Inspect the change**: from `aws.cloudtrail.request_parameters`, confirm which action occurred and its target
 50  (`detectorId`, IP set `location`/`name`, or the `enable` flag for `UpdateDetector`).
 51- **Assess scope**: for IP sets, resolve the listed CIDR ranges/addresses — do they belong to the adversary's known
 52  infrastructure rather than legitimate corporate ranges? For threat intel sets, review the referenced feed location.
 53- **Correlate with other defense evasion activity**: look for `DeleteDetector`, `StopMonitoringMembers`,
 54  `DisassociateMembers`, CloudTrail suspension, or IAM privilege changes around the same time by the same actor.
 55- **Review source context**: check `source.ip`, `user_agent.original`, and `source.geo` for anomalous access.
 56
 57### False positive analysis
 58
 59- Legitimate security engineering changes (adding a new VPN range to the trusted IP list, rotating a threat intel
 60  feed URL) will show the same API calls. Confirm with the GuardDuty/security engineering team and check change
 61  tickets or IaC pipelines before treating as malicious.
 62
 63### Response and remediation
 64
 65- If unauthorized, remove or deactivate the rogue IP set/threat intel set, and re-enable the detector if it was
 66  disabled (`UpdateDetector` with `Enable: true`).
 67- Review all findings generated (or suppressed) during the window the detector or IP set was compromised.
 68- Restrict `guardduty:CreateIPSet`, `guardduty:UpdateIPSet`, `guardduty:CreateThreatIntelSet`,
 69  `guardduty:UpdateThreatIntelSet`, and `guardduty:UpdateDetector` to a limited administrative role, and alert on any
 70  use outside change-managed windows.
 71
 72"""
 73references = [
 74    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateIPSet.html",
 75    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateIPSet.html",
 76    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateThreatIntelSet.html",
 77    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateThreatIntelSet.html",
 78    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html",
 79    "https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/guardduty__whitelist_ip",
 80]
 81risk_score = 73
 82rule_id = "e515aeb2-3d47-4925-b6fc-3f92b0d40d5b"
 83severity = "high"
 84tags = [
 85    "Domain: Cloud",
 86    "Data Source: AWS",
 87    "Data Source: Amazon Web Services",
 88    "Data Source: AWS GuardDuty",
 89    "Use Case: Threat Detection",
 90    "Tactic: Defense Evasion",
 91    "Resources: Investigation Guide",
 92]
 93timestamp_override = "event.ingested"
 94type = "query"
 95
 96query = '''
 97data_stream.dataset: "aws.cloudtrail"
 98    and event.provider: "guardduty.amazonaws.com"
 99    and event.outcome: "success"
100    and (
101        (event.action: ("CreateIPSet" or "UpdateIPSet" or "CreateThreatIntelSet" or "UpdateThreatIntelSet")
102            and aws.cloudtrail.flattened.request_parameters.activate: (true or "true"))
103        or
104        (event.action: "UpdateDetector" and aws.cloudtrail.flattened.request_parameters.enable: (false or "false"))
105    )
106'''
107
108
109[[rule.threat]]
110framework = "MITRE ATT&CK"
111[[rule.threat.technique]]
112id = "T1562"
113name = "Impair Defenses"
114reference = "https://attack.mitre.org/techniques/T1562/"
115[[rule.threat.technique.subtechnique]]
116id = "T1562.001"
117name = "Disable or Modify Tools"
118reference = "https://attack.mitre.org/techniques/T1562/001/"
119
120
121
122[rule.threat.tactic]
123id = "TA0005"
124name = "Defense Evasion"
125reference = "https://attack.mitre.org/tactics/TA0005/"
126
127[rule.investigation_fields]
128field_names = [
129    "@timestamp",
130    "user.name",
131    "user_agent.original",
132    "source.ip",
133    "aws.cloudtrail.user_identity.arn",
134    "aws.cloudtrail.user_identity.type",
135    "aws.cloudtrail.user_identity.access_key_id",
136    "event.action",
137    "event.outcome",
138    "cloud.account.id",
139    "cloud.region",
140    "aws.cloudtrail.request_parameters",
141]