aws-gd-disable-detector

Disable the GuardDuty detector via UpdateDetector(Enable=false), pausing all finding generation.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?detector`
permissions	`guardduty:UpdateDetector`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds effective guardduty:UpdateDetector. BLOCKED if an SCP or deny policy explicitly denies guardduty:UpdateDetector. The Enable=false field is the evasion-relevant mutation; the same permission also allows benign config changes (publishing frequency, data sources) — see false_positive_note.

source type

Identity

target type

SecurityService

source

?principal

target

?detector

permissions

guardduty:UpdateDetector

conditions

iam_permission

state logic

ACTIVE when ?principal holds effective guardduty:UpdateDetector. BLOCKED if an SCP or deny policy explicitly denies guardduty:UpdateDetector. The Enable=false field is the evasion-relevant mutation; the same permission also allows benign config changes (publishing frequency, data sources) — see false_positive_note.

Narrative

{principal.name} can disable the GuardDuty detector {detector.name} (guardduty:UpdateDetector with Enable=false), pausing all threat-detection finding generation. The detector remains present and can be re-enabled, but creates a detection gap for the duration of the attack.

Raw rule rules/derived/aws/guardduty.yaml

id: aws-gd-disable-detector
emits: CanModifyConfiguration
description: Disable the GuardDuty detector via UpdateDetector(Enable=false), pausing all finding generation.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:UpdateDetector on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:UpdateDetector
  conditions:
  - iam_permission
  state_logic: "ACTIVE when ?principal holds effective guardduty:UpdateDetector. BLOCKED if an SCP or\
    \ deny policy explicitly denies guardduty:UpdateDetector. The Enable=false field is the evasion-relevant\
    \ mutation; the same permission also allows benign config changes (publishing frequency, data sources)\
    \ \u2014 see false_positive_note."
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, guardduty:UpdateDetector, ?detector)
  false_positive_note: "guardduty:UpdateDetector is used for both benign configuration changes (adjusting\
    \ FindingPublishingFrequency, enabling/disabling optional data sources such as S3 Protection or EKS\
    \ audit logs) and for setting Enable=false. The CanModifyConfiguration edge is correct for all uses\
    \ because any config mutation of a detective control is security-relevant, but the highest-severity\
    \ case is Enable=false. Analysts should note that holding UpdateDetector does not guarantee the attacker\
    \ will disable the detector \u2014 it only creates the capability. This is NOT a privilege-escalation\
    \ edge; no CanExecuteAs or CanEnterAccount chains from here. Do not emit BLOCKED merely because the\
    \ detector is currently enabled \u2014 BLOCKED is for SCP/deny-policy guardrails, not current state."
  narrative: '{principal.name} can disable the GuardDuty detector {detector.name} (guardduty:UpdateDetector
    with Enable=false), pausing all threat-detection finding generation. The detector remains present
    and can be re-enabled, but creates a detection gap for the duration of the attack.'