Guardduty

Adversaries leverage specific AWS GuardDuty API calls including CreateIPSet, UpdateIPSet, CreateThreatIntelSet, UpdateThreatIntelSet, or UpdateDetector with Enable: false to suppress or blind Amazon GuardDuty's detection capabilities, allowing them to operate undetected within a compromised AWS environment.

Detection of AWS GuardDuty detector deletion via the DeleteDetector API, potentially indicating defense evasion by an attacker disabling threat monitoring and removing findings.

Adversaries may attempt to disassociate or manipulate Amazon GuardDuty member accounts within an AWS organization to break centralized visibility, allowing them to operate undetected in member accounts.