AWS GuardDuty Disabled or Tampered via CloudTrail (T1562.008)

Renata Cardoso@rcardososec

•updated Jul 1, 2026•0•0•10

Detects administrative actions that disable or modify Amazon GuardDuty, which could be an attempt to blind security monitoring or evade detection of malicious activity. This includes disabling a detector, deleting publishing destinations, or modifying threat intel and IP sets.