AWS GuardDuty Detection Suppression

Adversaries targeting Amazon Web Services environments have been observed utilizing legitimate GuardDuty API calls to disable or impair its detection mechanisms without outright deleting the service. This defense evasion tactic, described in a rule from Elastic, allows attackers to maintain persistence and operate covertly by preventing GuardDuty from generating findings on their malicious activities. The techniques involve creating or updating trusted IP sets (CreateIPSet/UpdateIPSet) to whitelist their command and control infrastructure, manipulating threat intelligence feeds (CreateThreatIntelSet/UpdateThreatIntelSet) to control what GuardDuty identifies as malicious, or soft-disabling the detector (UpdateDetector with Enable: false). These actions ensure that the GuardDuty detector remains configured and retains historical data, making the tampering less conspicuous than a complete deletion and therefore harder for defenders to detect promptly. This technique impacts any AWS user relying on GuardDuty for threat detection, allowing adversaries to bypass security controls and exfiltrate data or maintain access unnoticed.

Attack Chain

1. Initial Access & Privilege Escalation: An adversary gains initial access to an AWS environment, potentially through compromised credentials or exploitation of a vulnerable application, then escalates privileges to obtain IAM permissions capable of modifying GuardDuty settings.
2. Defense Evasion - IP Whitelisting: The attacker executes CreateIPSet or UpdateIPSet API calls via CloudTrail, supplying a list of IP addresses (typically their C2 infrastructure) to be designated as "trusted."
3. Activate IP Set: The trusted IP set is activated with the activate: true parameter, causing GuardDuty to ignore traffic originating from the specified addresses.
4. Defense Evasion - Threat Intelligence Manipulation: Alternatively, the attacker may use CreateThreatIntelSet or UpdateThreatIntelSet API calls to register or modify a threat intelligence feed that either omits known malicious indicators or introduces benign ones.
5. Activate Threat Intel Set: The manipulated threat intelligence set is activated, effectively controlling GuardDuty's understanding of what constitutes a threat.
6. Defense Evasion - Soft Disabling Detector: As another alternative, the attacker may issue an UpdateDetector API call with the Enable parameter set to false, effectively pausing GuardDuty without deleting its configuration or historical data.
7. Undetected Operations: With GuardDuty detections suppressed, the adversary proceeds with their objectives, such as data exfiltration or deploying additional malware, without generating security alerts from GuardDuty.

Impact

Successful exploitation of GuardDuty detection suppression allows adversaries to operate within a compromised AWS environment without triggering alerts, making detection and response significantly more challenging. This enables prolonged unauthorized access, data exfiltration, resource hijacking, or further lateral movement within the cloud infrastructure. The impact is primarily on the confidentiality, integrity, and availability of resources and data protected by GuardDuty. All AWS customers utilizing GuardDuty are potential targets. The primary damage is the complete blindness of a critical security service, allowing the attacker to evade monitoring and achieve their objectives unhindered.

Recommendation

• Deploy the Sigma rule "AWS GuardDuty Detection Suppression" to your SIEM to detect attempts to tamper with GuardDuty configurations.
• Monitor aws.cloudtrail logs for CreateIPSet, UpdateIPSet, CreateThreatIntelSet, UpdateThreatIntelSet, and UpdateDetector API calls, especially when the activate parameter is true or the enable parameter is false.
• Restrict guardduty:CreateIPSet, guardduty:UpdateIPSet, guardduty:CreateThreatIntelSet, guardduty:UpdateThreatIntelSet, and guardduty:UpdateDetector permissions to a highly limited administrative role, and implement strong access controls and multi-factor authentication for these roles.
• Review GuardDuty configuration changes, particularly those affecting IP sets, threat intelligence sets, or detector enablement status, by cross-referencing aws.cloudtrail.user_identity.arn and aws.cloudtrail.user_identity.type with expected administrative activities.
• Implement change management processes for legitimate GuardDuty tuning activities to distinguish authorized modifications from malicious attempts, using the aws.cloudtrail.user_identity.arn and aws.cloudtrail.request_parameters fields for verification.