AWS GuardDuty Important Change

Title: AWS GuardDuty Important Change
Status: test
Description:Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
References:
  -https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9
Author: faloker
Date: 2020-02-11
modified:2022-10-09
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_source:
    eventSource: 'guardduty.amazonaws.com'
    eventName: 'CreateIPSet'
  condition:selection_source
Falsepositives:
  -Valid change in the GuardDuty (e.g. to ignore internal scanners)
Level: high