AWS GuardDuty Disabled or Tampered via CloudTrail (T1562.008)

Renata Cardoso@rcardososec

•updated Jul 1, 2026•1•0•5

Detects modifications to AWS GuardDuty configurations, including disabling the detector, deleting publishing destinations, or altering threat intelligence sets and trusted IP lists. These actions could indicate an attempt to blind security monitoring or evade detection.