LoFP / security teams may legitimately register trusted ip ranges (vpns, scanners, nat gateways) or update threat intelligence feeds as part of normal guardduty tuning. verify whether the user identity, user agent, and/or hostname should be making changes to guardduty configuration. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• T1562

Sample rules

AWS GuardDuty Detection Suppression

• source: elastic
• technicques:
  • T1562

Description

Identifies attempts to suppress or blind Amazon GuardDuty without deleting the detector outright. Adversaries with GuardDuty permissions can create or update a trusted IP set (CreateIPSet/UpdateIPSet) so that traffic from listed addresses is never flagged, tamper with the threat intelligence feed used to generate findings (CreateThreatIntelSet/UpdateThreatIntelSet), or soft-disable the detector via UpdateDetector with Enable set to false. All three techniques leave the detector itself intact, evading detections that only look for detector deletion.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.outcome: "success"
    and (
        (event.action: ("CreateIPSet" or "UpdateIPSet" or "CreateThreatIntelSet" or "UpdateThreatIntelSet")
            and aws.cloudtrail.flattened.request_parameters.activate: (true or "true"))
        or
        (event.action: "UpdateDetector" and aws.cloudtrail.flattened.request_parameters.enable: (false or "false"))
    )