aws-securityhub-disable-controls

id: aws-securityhub-disable-controls
emits: CanModifyConfiguration
description: "Principal can disable Security Hub security controls, compliance standards, or the entire\
  \ service (securityhub:UpdateStandardsControl / securityhub:BatchDisableStandards / securityhub:DisableSecurityHub),\
  \ permanently preventing Security Hub from generating findings for those checks or disabling all detection\
  \ \u2014 a persistent defense-evasion action that does not grant resource access."
match:
- - principal: null
  - HasPermission
  - hub: null
where:
- node_type(?hub) == SecurityService
- node_class(?hub) == ManagementService
- ?hub.provider_type == 'AWS::SecurityHub::Hub'
- ?principal has EFFECTIVE securityhub:UpdateStandardsControl OR securityhub:BatchDisableStandards OR
  securityhub:DisableSecurityHub on ?hub
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?hub
  permissions:
  - securityhub:UpdateStandardsControl
  - securityhub:BatchDisableStandards
  - securityhub:DisableSecurityHub
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE if any of securityhub:UpdateStandardsControl, securityhub:BatchDisableStandards,
    or securityhub:DisableSecurityHub is in the principal's effective policy for the hub scope and no
    SCP or permission boundary denies it; BLOCKED if an explicit deny or SCP denies all three actions;
    CONDITIONAL(scp_or_org_policy) if org policy applicability is unknown.
  confidence: 0.92
  derived_from:
  - ?principal HasPermission ?hub (securityhub:UpdateStandardsControl or securityhub:BatchDisableStandards
    or securityhub:DisableSecurityHub effective)
  false_positive_note: "UpdateStandardsControl and BatchDisableStandards modify the Security Hub service\
    \ configuration (which checks run), not the findings themselves. DisableSecurityHub disables the entire\
    \ service in the caller's account and region, killing all finding generation from GuardDuty, Inspector,\
    \ Macie, Config, and IAM Access Analyzer integrations. All three are more persistent than BatchUpdateFindings\
    \ \u2014 disabled controls/service remain off until explicitly re-enabled. However, they remain detective-only;\
    \ no resource access or execution capability is gained. The delegated admin account can manage standards/controls\
    \ for member accounts via the Organizations integration, but DisableSecurityHub only disables the\
    \ service in the admin account itself, not in members. Emit only when the effective permission is\
    \ confirmed \u2014 do not assume AWSSecurityHubReadOnlyAccess grants these (it does not). Do NOT chain\
    \ to CanExecuteAs or CanEscalateTo."
  narrative: '{principal.name} can disable AWS Security Hub security controls (securityhub:UpdateStandardsControl),
    remove compliance standards (securityhub:BatchDisableStandards), or fully disable the Security Hub
    service (securityhub:DisableSecurityHub). Disabling controls or the service prevents Security Hub
    from generating findings, providing persistent cover for attacker activity by eliminating detection
    from GuardDuty, Inspector, Macie, and Config. Full service disablement is the highest-impact evasion
    action. This is a configuration-level defense evasion action and does not grant access to any AWS
    resource.'