Skip to content
Threat Feed
Subscribe

Product

Amazon GuardDuty

2 briefs RSS
high advisory

AWS GuardDuty Detection Suppression

Adversaries leverage specific AWS GuardDuty API calls including CreateIPSet, UpdateIPSet, CreateThreatIntelSet, UpdateThreatIntelSet, or UpdateDetector with Enable: false to suppress or blind Amazon GuardDuty's detection capabilities, allowing them to operate undetected within a compromised AWS environment.

Amazon GuardDuty defense-evasion cloud-security aws guardduty
1r 1t
high advisory

AWS GuardDuty Member Account Manipulation

Adversaries manipulate Amazon GuardDuty member accounts within an AWS organization by using API calls such as `DisassociateFromAdministratorAccount`, `DeleteMembers`, `StopMonitoringMembers`, or `DeleteInvitations` to break centralized security visibility, enabling them to operate undetected in compromised member accounts.

Amazon GuardDuty cloud aws defense-evasion amazon-guardduty
1r 1t