Improving GuardDuty’s Data Exfiltration Protections

Originally published by Gem Security. Written by Itay Harel and Ran Amos. A few weeks ago, Gem’s threat research team discovered a technique that could have allowed an attacker to bypass AWS GuardDuty’s threat detection service. Using these methods, threat actors in possession of IAM active credentials that had the power to update S3 bucket policies could have bypassed GuardDuty’s S3 detections and silently updated permissions for S3 resources, resulting in a bucket configuration that all...

amos aws bypass credentials data data exfiltration detection exfiltration gem gem security guardduty iam power research s3 bucket security service team threat threat actors threat detection threat research update written