LoFP / the guardduty detector may be deleted by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. detector deletions by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• T1562

Sample rules

AWS GuardDuty Detector Deletion

• source: elastic
• technicques:
  • T1562

Description

Detects the deletion of an Amazon GuardDuty detector. GuardDuty provides continuous monitoring for malicious or unauthorized activity across AWS accounts. Deleting the detector disables this visibility, stopping all threat detection and removing existing findings. Adversaries may delete GuardDuty detectors to impair security monitoring and evade detection during or after an intrusion. This rule identifies successful “DeleteDetector” API calls and can indicate a deliberate defense evasion attempt.

Detection logic

event.dataset: aws.cloudtrail 
  and event.provider: guardduty.amazonaws.com 
  and event.action: DeleteDetector 
  and event.outcome: success