GuardDuty, in its current state, is in its early stages and looks for a lot of low-hanging fruit to detect malicious activity in an environment. Many of these checks (and sometimes all of them) are simple to bypass and/or avoid during the attack process against an AWS environment. Although this chapter tried to cover all of what is known about GuardDuty right now, the service is being slowly updated and improved on as time goes by. This is especially because of the machine learning involved in its detection.
Because of where GuardDuty is at, it likely is not a great catch-all solution, so when you are attacking an AWS environment, it is important to keep in mind that it might not be the only thing that is watching you. Even if you are attacking an environment with GuardDuty alongside another monitoring tool, it will still be useful and practical to try and bypass GuardDuty...
