LoFP / decommissioning of a guardduty publishing destination during a planned security architecture migration may trigger this rule. validate that the deletion is associated with a known infrastructure change and that an alternative destination was configured.

Techniques

• T1562

Sample rules

AWS GuardDuty Publishing Destination Deleted

• source: elastic
• technicques:
  • T1562

Description

Detects the deletion of an Amazon GuardDuty publishing destination. Publishing destinations export GuardDuty findings to S3, Security Lake, or EventBridge for long-term retention and SIEM ingestion. An adversary with GuardDuty administrative access may delete a publishing destination to prevent findings from reaching external storage or a security operations center, reducing the visibility of their activity while leaving the GuardDuty detector active.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeletePublishingDestination"
    and event.outcome: "success"