Detection of Unauthorized AWS GuardDuty Threat Intelligence Set Deletion

Threat intelligence sets in Amazon GuardDuty provide a mechanism for security operations teams to upload custom lists of indicators, such as IP addresses or domains, that the service uses to generate high-priority security findings. An attacker who has achieved sufficient permissions in an AWS environment may intentionally delete these threat intelligence sets to degrade the visibility of GuardDuty. By removing these sets, the adversary effectively disables the detection of traffic associated with their own command-and-control infrastructure or other malicious activity, allowing them to operate within the environment while evading security alerts. This technique is a form of defense evasion intended to impair security monitoring tools and is typically observed after an attacker has established persistence or obtained high-privileged credentials.

Impact

Successful deletion of a threat intelligence set prevents GuardDuty from flagging traffic related to the indicators contained within the removed list. This can lead to undetected command-and-control communication, data exfiltration, or lateral movement, directly reducing the effectiveness of an organization's cloud security posture.

Recommendation

• Monitor AWS CloudTrail management events for the 'DeleteThreatIntelSet' action to identify potential attempts to impair security defenses.
• Implement IAM policies or Service Control Policies (SCPs) that restrict the 'guardduty:DeleteThreatIntelSet' permission to a dedicated, limited-access security operations role.
• Audit the frequency and timing of threat intel set deletions to differentiate between planned feed rotations and unauthorized modifications.
• Integrate AWS CloudTrail management events into the SIEM and deploy detection rules to alert on suspicious control-plane modifications.