AWS GuardDuty Important Change

Status: test
Severity: high
Log source: product aws, service cloudtrail
Author: faloker
Source: github.com/SigmaHQ/sigma

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

Known false positives

Valid change in the GuardDuty (e.g. to ignore internal scanners)

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateIPSet`: Creates a trusted IP set in GuardDuty, which causes GuardDuty to not generate findings for traffic from the listed IP addresses.

Rules detecting the same action

These rules filter on the same operation.

AWS GuardDuty Detection Suppression (Elastic)
AWS Trusted IPSet Modified (Panther)

Rule body

title: AWS GuardDuty Important Change
id: 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
status: test
description: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
references:
    - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9
author: faloker
date: 2020-02-11
modified: 2022-10-09
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: guardduty.amazonaws.com
        eventName: CreateIPSet
    condition: selection_source
falsepositives:
    - Valid change in the GuardDuty (e.g. to ignore internal scanners)
level: high

Stages and Predicates

Stage 0: `condition`

selection_source

Stage 1: `selection_source`

selection_source:
    eventSource: guardduty.amazonaws.com
    eventName: CreateIPSet

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateIPSet`	`field:"aws::eventName" kind:eq value:"CreateIPSet"`
`eventSource`	eq	`guardduty.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"guardduty.amazonaws.com"`