aws-securityhub-disable-service
Principal can fully disable AWS Security Hub (securityhub:DisableSecurityHub), eliminating all detection from GuardDuty, Inspector, Macie, Config, and IAM Access Analyzer integrations - the highest-impact defense-evasion primitive that does not grant resource access.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
SecurityService
node_class(?hub) == ManagementService
?hub.provider_type == 'AWS::SecurityHub::Hub'
?principal has EFFECTIVE securityhub:DisableSecurityHub on ?hub
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | ?principal |
| target | ?hub |
| permissions | securityhub:DisableSecurityHub |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE if securityhub:DisableSecurityHub is in the principal's effective policy and no SCP or permission boundary denies it; BLOCKED if explicitly denied. |
Narrative
{principal.name} can fully disable AWS Security Hub in this region (securityhub:DisableSecurityHub), eliminating all finding generation from GuardDuty, Inspector, Macie, AWS Config, and IAM Access Analyzer. This is a nuclear option for defense evasion - it stops all detective controls from generating findings, providing perfect cover for ongoing attacker activity. Unlike disabling individual controls, re-enabling the service requires manual intervention and would trigger alerts. This is the most high-impact evasion action in Security Hub and does not grant access to any AWS resource.
Raw rule rules/derived/aws/securityhub.yaml
id: aws-securityhub-disable-service
emits: CanModifyConfiguration
description: "Principal can fully disable AWS Security Hub (securityhub:DisableSecurityHub), eliminating\
\ all detection from GuardDuty, Inspector, Macie, Config, and IAM Access Analyzer integrations \u2014\
\ the highest-impact defense-evasion primitive that does not grant resource access."
match:
- - principal: null
- HasPermission
- hub: null
where:
- node_type(?hub) == SecurityService
- node_class(?hub) == ManagementService
- ?hub.provider_type == 'AWS::SecurityHub::Hub'
- ?principal has EFFECTIVE securityhub:DisableSecurityHub on ?hub
emit:
source_type: Identity
target_type: SecurityService
source: ?principal
target: ?hub
permissions:
- securityhub:DisableSecurityHub
conditions:
- iam_permission
- scp_or_org_policy
state_logic: ACTIVE if securityhub:DisableSecurityHub is in the principal's effective policy and no
SCP or permission boundary denies it; BLOCKED if explicitly denied.
confidence: 0.95
derived_from:
- ?principal HasPermission ?hub (securityhub:DisableSecurityHub effective)
false_positive_note: "DisableSecurityHub is a regional action scoped to the caller's account only \u2014\
\ it cannot disable Security Hub in other accounts (even if the caller is a delegated administrator).\
\ This is the most dangerous evasion action available in Security Hub because it not only hides findings\
\ but stops all collection mechanisms (GuardDuty, Inspector, Macie, Config, IAM Access Analyzer) from\
\ writing new findings. Once disabled, Security Hub must be manually re-enabled, which is a heavyweight\
\ recovery action that would likely trigger incident response. Emit only when the effective permission\
\ is confirmed. Do NOT chain to CanExecuteAs or CanEscalateTo \u2014 this is cover-tracks, not privilege\
\ escalation."
narrative: "{principal.name} can fully disable AWS Security Hub in this region (securityhub:DisableSecurityHub),\
\ eliminating all finding generation from GuardDuty, Inspector, Macie, AWS Config, and IAM Access\
\ Analyzer. This is a nuclear option for defense evasion \u2014 it stops all detective controls from\
\ generating findings, providing perfect cover for ongoing attacker activity. Unlike disabling individual\
\ controls, re-enabling the service requires manual intervention and would trigger alerts. This is\
\ the most high-impact evasion action in Security Hub and does not grant access to any AWS resource."