There are three GuardDuty alerts under the PenTest category of findings types. These findings are PenTest:IAMUser/KaliLinux, PenTest:IAMUser/ParrotLinux, and PenTest:IAMUser/PentooLinux, which alert when AWS API calls are made from a Kali Linux server, Parrot Linux server, or Pentoo Linux server, respectively. These are rather simple to bypass, as long as you know what is causing them to get detected.
Regardless of the client you are using to interact with the API, whether that is one of the SDKs from the various languages that are supported (such as Java, Python, or Node.js), the AWS CLI (which uses Python behind the scenes), the AWS web console, or just raw HTTP requests, you will always have ...
