An AWS GuardDuty IP set was created

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Log Tampering Analytics
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685)
Severity	Informational

Description

An AWS GuardDuty IP set has been created.

Attacker's Goals

Evade detection.

Investigative actions

Check which IP set has been modified and confirm the changes.