aws-gd-update-publishing-destination

id: aws-gd-update-publishing-destination
emits: CanModifyConfiguration
description: Redirect GuardDuty findings export to an attacker-controlled S3 bucket, exfiltrating security
  telemetry and severing central SOC visibility.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:UpdatePublishingDestination on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:UpdatePublishingDestination
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective guardduty:UpdatePublishingDestination. BLOCKED if
    an SCP denies guardduty:UpdatePublishingDestination.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, guardduty:UpdatePublishingDestination, ?detector)
  false_positive_note: 'Legitimate use: changing publishing destination for operational reasons (different
    S3 bucket for lifecycle archival, switching from S3 to Detective graph). The evasion value is highest
    when the attacker controls the new destination (attacker-managed S3 bucket with anonymous read access,
    or a compromised account whose Detective graph exports to the attacker). This edge is correct regardless
    of the new destination because the permission grants the capability to redirect at any time. It combines
    two attack patterns: (1) exfiltration of findings (operational telemetry useful for reconnaissance
    and understanding SOC detection capabilities) and (2) cover-tracks (severing the central export if
    the new destination is inaccessible or if the attacker deletes the original destination, causing the
    export to fail). Not a privilege-escalation path. Confidence 0.85 reflects that destination redirection
    alone does not guarantee exfiltration (attacker must also control the new destination and have credentials
    to read it).'
  narrative: '{principal.name} can redirect GuardDuty findings exports from {detector.name} (guardduty:UpdatePublishingDestination)
    to an attacker-controlled S3 bucket or account, exfiltrating all exported findings (including finding
    metadata, IOCs, account IDs, instance IDs, and API call patterns) and potentially severing the central
    SOC''s monitoring stream.'