aws-gd-trusted-ip-suppress

id: aws-gd-trusted-ip-suppress
emits: CanModifyConfiguration
description: Add attacker-controlled IPs to a GuardDuty trusted-IP set (IPSet), suppressing network-based
  findings for those addresses.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:CreateIPSet OR guardduty:UpdateIPSet on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:CreateIPSet
  - guardduty:UpdateIPSet
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective guardduty:CreateIPSet or guardduty:UpdateIPSet.
    The IPSet content is set at write time. BLOCKED if an SCP denies both IPSet write actions.
  confidence: 0.8
  derived_from:
  - HasPermission(?principal, guardduty:CreateIPSet|guardduty:UpdateIPSet, ?detector)
  false_positive_note: "Trusted-IP sets are legitimate for VPN egress IPs, NAT gateway IPs, and known\
    \ scanner IPs that generate false positives. Evasion requires the attacker to know and control the\
    \ IPs they will use for exfiltration or C2 \u2014 opportunistic attackers without fixed egress IPs\
    \ gain little from this. Most network-based GuardDuty findings (port scans, DNS exfil, crypto-mining\
    \ calls) are suppressed by IPSet entries, but host-based findings (IAM anomalies, API call patterns)\
    \ are not \u2014 this provides partial not total evasion. Confidence 0.80 reflects this partial effectiveness.\
    \ Not a privilege-escalation path."
  narrative: '{principal.name} can create or update GuardDuty trusted-IP sets on {detector.name} (guardduty:CreateIPSet
    / guardduty:UpdateIPSet) to add their source IPs, suppressing network-anomaly findings (port scan,
    DNS exfil, crypto-mining calls to known endpoints) originating from those addresses.'