aws-detective-delete-graph
Deleting the Detective behavior graph is a defense-evasion / cover-tracks primitive that reduces investigative coverage (ADMINISTRATOR ONLY). Emits CanModifyConfiguration on the SecurityService node.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?graph) ==
SecurityService
?graph.provider_type == 'AWS::Detective::Graph'
effective_permission(?principal, ?graph, detective:DeleteGraph)
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | ?principal |
| target | ?graph |
| permissions | detective:DeleteGraph |
| conditions | iam_permission scp_or_org_policy permission_boundary |
| state logic | ACTIVE when the IAM effective-permission evaluator confirms detective:DeleteGraph on the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when the permission is policy-present but resource-scope is unresolved (e.g. wildcard resource without a confirmed matching graph ARN). BLOCKED when an SCP or permission boundary denies detective:DeleteGraph on the graph ARN — detective controls are not preventive; the BLOCKED here reflects the evasion action being blocked, not a protected resource. |
Narrative
{principal.name} can delete the Amazon Detective behavior graph {graph.name}, preventing security teams from correlating CloudTrail, VPC Flow Log, and GuardDuty data for investigation. This is a defense-evasion primitive - it reduces detection coverage but does not grant access to any resource. Only the graph administrator can delete the graph.
Raw rule rules/derived/aws/detective.yaml
id: aws-detective-delete-graph
emits: CanModifyConfiguration
description: Deleting the Detective behavior graph is a defense-evasion / cover-tracks primitive that
reduces investigative coverage (ADMINISTRATOR ONLY). Emits CanModifyConfiguration on the SecurityService
node.
applies_to:
- aws
match:
- - principal: null
- HasPermission
- graph: null
where:
- node_type(?graph) == SecurityService
- ?graph.provider_type == 'AWS::Detective::Graph'
- effective_permission(?principal, ?graph, detective:DeleteGraph)
emit:
source_type: Identity
target_type: SecurityService
source: ?principal
target: ?graph
permissions:
- detective:DeleteGraph
conditions:
- iam_permission
- scp_or_org_policy
- permission_boundary
state_logic: "ACTIVE when the IAM effective-permission evaluator confirms detective:DeleteGraph on the\
\ graph ARN with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when the permission\
\ is policy-present but resource-scope is unresolved (e.g. wildcard resource without a confirmed matching\
\ graph ARN). BLOCKED when an SCP or permission boundary denies detective:DeleteGraph on the graph\
\ ARN \u2014 detective controls are not preventive; the BLOCKED here reflects the evasion action being\
\ blocked, not a protected resource."
confidence: 0.95
derived_from:
- ?principal HasPermission ?graph
false_positive_note: "This edge represents a COVER-TRACKS / weaken-defenses capability only. Disabling\
\ Detective does NOT unblock any preventive control (SCP, IAM deny, GuardDuty still fires \u2014 GuardDuty\
\ is a separate service). Do NOT chain this edge to CanExecuteAs, CanEnterAccount, or any privilege-escalation\
\ edge. This is ADMINISTRATOR ONLY \u2014 the admin account that owns the graph. Prefer CONDITIONAL\
\ when graph ARN resolution is incomplete."
narrative: "{principal.name} can delete the Amazon Detective behavior graph {graph.name}, preventing\
\ security teams from correlating CloudTrail, VPC Flow Log, and GuardDuty data for investigation.\
\ This is a defense-evasion primitive \u2014 it reduces detection coverage but does not grant access\
\ to any resource. Only the graph administrator can delete the graph."