The best and most effective way to bypass all of GuardDuty is to just add your own attacker IP address to the list of trusted IP addresses in the target account. It is a simple process and GuardDuty doesn't trigger anything to do with the enumeration or modification of GuardDuty settings, so it will likely fly under the radar, even in more modern, advanced environments. If we look at the Lists tab of GuardDuty in the AWS web console, we will see something similar to the following screenshot:
Showing GuardDuty's trusted IP lists and threat lists in the AWS web console
In this screenshot, we can see ...
