Summary
GuardDuty detected CloudTrail being outright disabled, but did not detect if an attacker with the
necessary permissions filtered out all events from CloudTrail via PutEventSelectors, resulting in
defenders having no logs to review. AWS fixed this issue by adding a GuardDuty detection that
triggers if PutEventSelectors is used to disable all event types.
Affected Services
GuardDuty
Remediation
As a safety measure, set up additional detections independent of GuardDuty.
Tracked CVEs
No tracked CVEs
References
https://github.com/RhinoSecurityLabs/Cloud-Security-Research/tree/master/AWS/cloudtrail_guardduty_bypasshttps://twitter.com/0xdabbad00/status/1258909131605307393
Contributed by https://github.com/0xdabbad00
Entry Status
Finalized
Disclosure Date
Thu, Apr 23rd, 2020
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Spencer Gietzen, Rhino Security
