Skip to content
Threat Feed
Subscribe

Product

AWS GuardDuty

3 briefs RSS
high advisory

AWS Security Services Impairment via Deletion Operations

Attackers attempt to impair or disable AWS security services such as GuardDuty, WAF, CloudWatch, Route 53 and CloudWatch Logs by deleting detectors, rule groups, IP sets, web ACLs, logging configurations, alarms and log streams, in order to evade detection and operate undetected.

AWS GuardDuty +4 aws cloudtrail defense-evasion
3r 1t
low advisory

AWS IAM API Calls via Temporary Session Tokens

Detection of AWS IAM API operations using temporary session credentials, indicating potential credential theft, session hijacking, or privileged role abuse for persistence and defense evasion.

AWS Identity and Access Management +2 cloud aws iam session-token persistence privilege-escalation
3r 2t
high advisory

AWS GuardDuty IP Set Manipulation for Defense Impairment

An attacker modifies AWS GuardDuty IP sets, potentially whitelisting malicious IPs to disable security alerts and impair defenses.

AWS GuardDuty defense-impairment aws
2r 1t