---
title: AWS GuardDuty Detection Suppression
description: Identifies attempts to suppress or blind Amazon GuardDuty without deleting the detector outright. Adversaries with GuardDuty permissions can create or...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_guardduty_finding_suppression
products:
  - Elastic Security
---

# AWS GuardDuty Detection Suppression
Identifies attempts to suppress or blind Amazon GuardDuty without deleting the detector outright. Adversaries with
GuardDuty permissions can create or update a trusted IP set (CreateIPSet/UpdateIPSet) so that traffic from listed
addresses is never flagged, tamper with the threat intelligence feed used to generate findings
(CreateThreatIntelSet/UpdateThreatIntelSet), or soft-disable the detector via UpdateDetector with Enable set to
false. All three techniques leave the detector itself intact, evading detections that only look for detector deletion.
**Rule type**: query
**Rule indices**:
- logs-aws.cloudtrail-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateIPSet.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateIPSet.html)](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateIPSet.html)
- [[https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateIPSet.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateIPSet.html)](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateIPSet.html)
- [[https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateThreatIntelSet.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateThreatIntelSet.html)](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateThreatIntelSet.html)
- [[https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateThreatIntelSet.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateThreatIntelSet.html)](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateThreatIntelSet.html)
- [[https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html)](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html)
- [[https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/guardduty__whitelist_ip](https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/guardduty__whitelist_ip)](https://github.com/RhinoSecurityLabs/pacu/tree/master/pacu/modules/guardduty__whitelist_ip)

**Tags**:
- Domain: Cloud
- Data Source: AWS
- Data Source: Amazon Web Services
- Data Source: AWS GuardDuty
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Fast
- Rule Type: Custom Query (KQL)
- Platform: AWS
- Data Source: AWS CloudTrail
- Service: AWS GuardDuty

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating AWS GuardDuty Detection Suppression

Amazon GuardDuty relies on its detector configuration, trusted IP list, and threat intelligence feeds to decide which
activity generates findings. An adversary who cannot (or does not want to) delete the detector outright can instead
blind it in place:
- **`CreateIPSet`/`UpdateIPSet`** (activated): traffic from any address in the list is treated as trusted and will
  not generate findings, even if it originates from the adversary's own infrastructure.
- **`CreateThreatIntelSet`/`UpdateThreatIntelSet`** (activated): replaces or extends the indicators GuardDuty uses to
  flag known-malicious activity; an adversary who controls this feed controls what GuardDuty considers malicious.
- **`UpdateDetector`** with `Enable: false`: disables the detector without deleting it, leaving its configuration and
  historical findings intact while stopping all new analysis — quieter than `DeleteDetector`, which has its own
  dedicated detection.


### Possible investigation steps

- **Identify the actor**: review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to
  determine who made the change, and whether this principal normally performs GuardDuty administration.
- **Inspect the change**: from `aws.cloudtrail.request_parameters`, confirm which action occurred and its target
  (`detectorId`, IP set `location`/`name`, or the `enable` flag for `UpdateDetector`).
- **Assess scope**: for IP sets, resolve the listed CIDR ranges/addresses — do they belong to the adversary's known
  infrastructure rather than legitimate corporate ranges? For threat intel sets, review the referenced feed location.
- **Correlate with other defense evasion activity**: look for `DeleteDetector`, `StopMonitoringMembers`,
  `DisassociateMembers`, CloudTrail suspension, or IAM privilege changes around the same time by the same actor.
- **Review source context**: check `source.ip`, `user_agent.original`, and `source.geo` for anomalous access.


### False positive analysis

- Legitimate security engineering changes (adding a new VPN range to the trusted IP list, rotating a threat intel
  feed URL) will show the same API calls. Confirm with the GuardDuty/security engineering team and check change
  tickets or IaC pipelines before treating as malicious.


### Response and remediation

- If unauthorized, remove or deactivate the rogue IP set/threat intel set, and re-enable the detector if it was
  disabled (`UpdateDetector` with `Enable: true`).
- Review all findings generated (or suppressed) during the window the detector or IP set was compromised.
- Restrict `guardduty:CreateIPSet`, `guardduty:UpdateIPSet`, `guardduty:CreateThreatIntelSet`,
  `guardduty:UpdateThreatIntelSet`, and `guardduty:UpdateDetector` to a limited administrative role, and alert on any
  use outside change-managed windows.


## Rule Query

```kuery
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.outcome: "success"
    and (
        (event.action: ("CreateIPSet" or "UpdateIPSet" or "CreateThreatIntelSet" or "UpdateThreatIntelSet")
            and aws.cloudtrail.flattened.request_parameters.activate: (true or "true"))
        or
        (event.action: "UpdateDetector" and aws.cloudtrail.flattened.request_parameters.enable: (false or "false"))
    )
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Impair Defenses
  - Id: T1562
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/](https://attack.mitre.org/techniques/T1562/)](https://attack.mitre.org/techniques/T1562/)
- Sub Technique:
  - Name: Disable or Modify Tools
  - Id: T1562.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/001/](https://attack.mitre.org/techniques/T1562/001/)](https://attack.mitre.org/techniques/T1562/001/)