aws-gd-suppress-findings-filter

id: aws-gd-suppress-findings-filter
emits: CanModifyConfiguration
description: Create or update a GuardDuty filter to auto-archive (suppress) specific findings, enabling
  stealthy evasion while the detector appears operational.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:CreateFilter OR guardduty:UpdateFilter on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:CreateFilter
  - guardduty:UpdateFilter
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective guardduty:CreateFilter or guardduty:UpdateFilter.
    The filter does not need to pre-exist for CreateFilter. BLOCKED if an SCP denies both filter write
    actions.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, guardduty:CreateFilter|guardduty:UpdateFilter, ?detector)
  false_positive_note: "Filters with Action=NOOP (i.e. tagging-only) or low-severity suppression (Severity\
    \ <= 1) are normal operational noise reduction. The evasion-relevant case is Action=ARCHIVE targeting\
    \ high-severity findings or broad criteria (e.g. all findings with a specific instanceId, IP, or finding\
    \ type covering the attacker's TTPs). The edge is correct regardless of the filter's current content\
    \ because the permission grants the capability to create an evasive filter at any time. This is stealthier\
    \ than disabling the detector because the detector remains ENABLED \u2014 monitoring dashboards show\
    \ no anomaly. Do not chain to privilege escalation. Confidence is slightly lower (0.85) than Delete/Disable\
    \ because the suppression is targeted and reversible, and an analyst may notice the filter."
  narrative: '{principal.name} can create or update GuardDuty filters on {detector.name} (guardduty:CreateFilter
    / guardduty:UpdateFilter) to automatically archive specific finding types. The detector remains ENABLED,
    creating the appearance of normal operation while targeted attacker activity is silently suppressed.'