aws-gd-read-findings

id: aws-gd-read-findings
emits: CanRead
description: "Read GuardDuty findings to enumerate detected threats \u2014 useful for an attacker to confirm\
  \ whether their activity was detected."
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:ListFindings AND guardduty:GetFindings on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:ListFindings
  - guardduty:GetFindings
  conditions:
  - iam_permission
  state_logic: ACTIVE when both list and get findings are effective. BLOCKED if SCP denies either action.
  confidence: 0.75
  derived_from:
  - HasPermission(?principal, guardduty:ListFindings, ?detector)
  - HasPermission(?principal, guardduty:GetFindings, ?detector)
  false_positive_note: "Read access to findings is low attack value on its own \u2014 it provides situational\
    \ awareness to the attacker (have I been detected?) but does not suppress findings or grant access.\
    \ Many legitimate roles (SOC analysts, audit accounts) hold this permission. Confidence is 0.75 because\
    \ the finding content (account IDs, instance IDs, network IOCs, API call patterns) is operationally\
    \ sensitive but does not constitute credential material. Do NOT emit ContainsSecret or CanReadSecret\
    \ for GuardDuty findings. This edge is for reconnaissance modeling only."
  narrative: '{principal.name} can list and retrieve GuardDuty findings from {detector.name} (guardduty:ListFindings,
    guardduty:GetFindings), allowing an attacker to enumerate what threat activity has been detected and
    confirm whether their prior actions generated observable findings.'