Guardduty - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/guardduty/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 12:00:00 +0000AWS GuardDuty Detector Deletionhttps://feed.craftedsignal.io/briefs/2024-01-09-aws-guardduty-deletion/Tue, 09 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-09-aws-guardduty-deletion/Detection of AWS GuardDuty detector deletion via the DeleteDetector API, potentially indicating defense evasion by an attacker disabling threat monitoring and removing findings.The AWS GuardDuty Detector Deletion rule identifies successful DeleteDetector API calls, which could signal an attacker attempting to impair defenses and evade detection within an AWS environment. GuardDuty is a continuous threat detection service that monitors CloudTrail, DNS logs, and VPC Flow Logs to identify malicious activity. Deleting the detector stops all monitoring and permanently removes historical findings for the affected AWS account, thus creating a blind spot for security teams. This activity is often indicative of a post-compromise scenario where the attacker seeks to remove traces of their presence and hinder incident response efforts. This rule is relevant for organizations that rely on GuardDuty for threat detection and incident response in their AWS environments. The original rule was created on 2020/05/28 and updated on 2026/04/10.

Attack Chain

  1. Initial access is gained to an AWS account through compromised credentials or a vulnerability in an exposed service.
  2. The attacker escalates privileges within the AWS environment to gain sufficient permissions to manage GuardDuty.
  3. The attacker uses the AWS CLI or API to execute the DeleteDetector API call, targeting the GuardDuty detector in a specific region.
  4. The DeleteDetector API call succeeds, disabling GuardDuty monitoring and deleting existing findings.
  5. The attacker performs malicious activities within the AWS environment, such as lateral movement, data exfiltration, or resource tampering, without detection by GuardDuty.
  6. The attacker may attempt to delete or modify CloudTrail logs to further obscure their activity and hinder forensic analysis.
  7. The attacker completes their objectives, such as deploying ransomware or stealing sensitive data.
  8. The attacker attempts to remove or obfuscate any remaining logs, making it difficult to trace back to the initial intrusion.

Impact

Successful deletion of a GuardDuty detector can severely compromise an organization's security posture in AWS. It allows attackers to operate undetected, leading to potential data breaches, financial loss, and reputational damage. The loss of GuardDuty's continuous monitoring can extend the dwell time of attackers within the environment, increasing the potential for significant damage. Organizations across all sectors that rely on AWS are at risk. The impact can range from data exfiltration and resource hijacking to full-scale ransomware deployment, depending on the attacker's objectives.

Recommendation

  • Deploy the Sigma rule AWS GuardDuty Detector Deletion to your SIEM to detect unauthorized deletions of GuardDuty detectors.
  • Review aws.cloudtrail.user_identity.arn from CloudTrail logs to identify the actor initiating the DeleteDetector API call.
  • Implement AWS Config rules or Security Hub controls to alert on changes to GuardDuty detectors or configuration states as described in the overview.
  • Restrict guardduty:DeleteDetector permissions to a limited administrative role using IAM policies.
  • Enable AWS CloudTrail logging and monitor for DeleteDetector events, ensuring logs are stored securely and retained for a sufficient period.
  • Investigate any DeleteDetector API calls that do not correspond to legitimate account decommissioning, region cleanup, or migration activity as described in the "False positive analysis" section.
]]>highadvisorycloudawsguarddutydefense-evasionAWS GuardDuty Member Account Manipulationhttps://feed.craftedsignal.io/briefs/2024-01-aws-guardduty-member-manipulation/Wed, 03 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-guardduty-member-manipulation/Adversaries may attempt to disassociate or manipulate Amazon GuardDuty member accounts within an AWS organization to break centralized visibility, allowing them to operate undetected in member accounts.This alert detects attempts to disassociate or manipulate Amazon GuardDuty member accounts within an AWS organization. In multi-account GuardDuty deployments, a delegated administrator account aggregates findings from member accounts. Attackers who have compromised a member account, or the administrator account, may attempt to break this centralized visibility by disassociating member accounts, deleting member relationships, stopping monitoring of members, or deleting pending invitations. These actions can precede or substitute for deleting GuardDuty detectors entirely, enabling attackers to operate undetected in member accounts while the administrator account loses visibility. The rule identifies successful API calls that manipulate GuardDuty member relationships within AWS, which are rare and warrant investigation.

Attack Chain

  1. An attacker gains initial access to an AWS account, potentially through compromised credentials or an EC2 instance.
  2. The attacker enumerates GuardDuty member accounts and the delegated administrator account.
  3. If the attacker has compromised a member account, they attempt to call the DisassociateFromAdministratorAccount or DisassociateMembers API to break the connection to the administrator account.
  4. Alternatively, if the attacker has compromised the administrator account, they call DeleteMembers or StopMonitoringMembers to remove or stop monitoring member accounts.
  5. The attacker may also call DeleteInvitations to prevent member accounts from associating with the GuardDuty administrator.
  6. After successfully manipulating the member account relationships, the attacker performs malicious actions within the affected AWS accounts, such as deploying malware, exfiltrating data, or establishing persistence.
  7. The attacker avoids detection by the central GuardDuty administrator account because the compromised member accounts are no longer actively monitored.
  8. The attacker may attempt to delete CloudTrail logs or other security configurations to further evade detection.

Impact

A successful attack can lead to a significant loss of visibility into the security posture of AWS member accounts. If GuardDuty monitoring is disrupted, attackers can operate undetected, potentially leading to data breaches, resource hijacking, or other malicious activities. The number of affected accounts depends on the scope of the attack and the attacker's objectives. This is especially critical for organizations relying on centralized security monitoring and incident response across multiple AWS accounts.

Recommendation

  • Deploy the Sigma rule "AWS GuardDuty Member Account Manipulation" to your SIEM and tune for your environment.
  • Restrict IAM permissions for guardduty:DisassociateFromAdministratorAccount, guardduty:DeleteMembers, guardduty:StopMonitoringMembers, and guardduty:DeleteInvitations to only authorized personnel.
  • Monitor CloudTrail logs for any unauthorized API calls related to GuardDuty member account manipulation.
  • Implement Service Control Policies (SCPs) to prevent member accounts from disassociating from GuardDuty administrators, as referenced in the overview.
  • Enable AWS Security Hub controls to detect changes to GuardDuty organization configurations, as mentioned in the hardening section.
  • Investigate any alerts generated by the Sigma rule "AWS GuardDuty Member Account Manipulation" by following the triage and analysis steps outlined in the rule documentation.
]]>mediumadvisoryawsguarddutydefense_evasion