LoFP / removal of an outdated or inaccurate threat intelligence set during a scheduled feed rotation may trigger this rule. confirm the deletion corresponds to a planned feed update and that a replacement set was activated.

Techniques

• T1562

Sample rules

AWS GuardDuty Threat Intelligence Set Deleted

• source: elastic
• technicques:
  • T1562

Description

Detects the deletion of an Amazon GuardDuty threat intelligence set. Threat intelligence sets are custom lists of known-malicious IP addresses or domains that GuardDuty uses to generate findings when monitored resources communicate with those indicators. Deleting a threat intel set degrades GuardDuty’s detection capability for known adversary infrastructure, allowing communication with threat-actor-controlled IP ranges to go undetected.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeleteThreatIntelSet"
    and event.outcome: "success"