aws-gd-disassociate-member

Sever a member account's GuardDuty aggregation link to the Organizations delegated administrator, creating a central-monitoring blind spot.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'detector': None}

where

node_type(?detector) == SecurityService ?detector.provider_type == 'AWS::GuardDuty::Detector' ?principal has EFFECTIVE guardduty:DisassociateFromAdministratorAccount OR guardduty:DisassociateMembers on ?detector ?detector is in a member account of a GuardDuty Organizations configuration (GetAdministratorAccount returns a non-empty administrator)

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?detector`
permissions	`guardduty:DisassociateFromAdministratorAccount` `guardduty:DisassociateMembers`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when ?principal holds the effective permission AND the account is currently managed (GetAdministratorAccount / ListMembers confirms the relationship). CONDITIONAL(service_state) when the membership state cannot be confirmed. BLOCKED if SCP denies the disassociate action.

Narrative

{principal.name} can sever {detector.name}'s connection to the GuardDuty Organizations delegated administrator (guardduty:DisassociateFromAdministratorAccount or guardduty:DisassociateMembers), removing this account from centralized security monitoring. Local findings are still generated but invisible to the central SOC.

Raw rule rules/derived/aws/guardduty.yaml

id: aws-gd-disassociate-member
emits: CanModifyConfiguration
description: Sever a member account's GuardDuty aggregation link to the Organizations delegated administrator,
  creating a central-monitoring blind spot.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:DisassociateFromAdministratorAccount OR guardduty:DisassociateMembers
  on ?detector
- ?detector is in a member account of a GuardDuty Organizations configuration (GetAdministratorAccount
  returns a non-empty administrator)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:DisassociateFromAdministratorAccount
  - guardduty:DisassociateMembers
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when ?principal holds the effective permission AND the account is currently managed
    (GetAdministratorAccount / ListMembers confirms the relationship). CONDITIONAL(service_state) when
    the membership state cannot be confirmed. BLOCKED if SCP denies the disassociate action.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, guardduty:DisassociateFromAdministratorAccount|guardduty:DisassociateMembers,
    ?detector)
  - service_state(administrator_relationship_active)
  false_positive_note: "Only meaningful when an Organizations delegated-administrator relationship is\
    \ active. If GuardDuty is deployed per-account without Organizations aggregation, this action has\
    \ no additional impact beyond local detector management. The cover-tracks value is limited to central/org-level\
    \ monitoring: the member account's local detector still generates findings visible to local principals.\
    \ This is NOT a cross-account escalation \u2014 do not emit CanEnterAccount. The disassociation removes\
    \ the member from central aggregation but does not grant the attacker access to the admin account\
    \ or any other account."
  narrative: '{principal.name} can sever {detector.name}''s connection to the GuardDuty Organizations
    delegated administrator (guardduty:DisassociateFromAdministratorAccount or guardduty:DisassociateMembers),
    removing this account from centralized security monitoring. Local findings are still generated but
    invisible to the central SOC.'