AWS GuardDuty Publishing Destination Deleted

  1[metadata]
  2creation_date = "2026/08/14"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the deletion of an Amazon GuardDuty publishing destination. Publishing destinations
 11export GuardDuty findings to S3, Security Lake, or EventBridge for long-term retention and
 12SIEM ingestion. An adversary with GuardDuty administrative access may delete a publishing
 13destination to prevent findings from reaching external storage or a security operations center,
 14reducing the visibility of their activity while leaving the GuardDuty detector active.
 15"""
 16false_positives = [
 17    """
 18    Decommissioning of a GuardDuty publishing destination during a planned security architecture
 19    migration may trigger this rule. Validate that the deletion is associated with a known
 20    infrastructure change and that an alternative destination was configured.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-aws.cloudtrail-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS GuardDuty Publishing Destination Deleted"
 28note = """## Triage and analysis
 29
 30### Investigating AWS GuardDuty Publishing Destination Deleted
 31
 32Amazon GuardDuty publishing destinations export threat findings to S3 buckets, Amazon Security Lake, or EventBridge buses for retention and downstream SIEM ingestion. Deleting a publishing destination severs this pipeline: findings still appear in the GuardDuty console but are no longer exported, making it harder for security operations to correlate GuardDuty alerts with other event sources.
 33
 34This action is uncommon in production environments. Legitimate deletions occur during planned migrations to a new destination or when decommissioning GuardDuty in an account.
 35
 36### Possible investigation steps
 37
 38- Identify the caller from `aws.cloudtrail.user_identity.arn` and `user.name`. Verify this identity has a documented reason to modify GuardDuty configuration.
 39- Check `aws.cloudtrail.request_parameters` for the destination ID and detector ID. Query GuardDuty to confirm whether any publishing destination remains configured.
 40- Review CloudTrail for other GuardDuty control-plane actions by the same identity in the surrounding time window: `DeleteDetector`, `UpdateDetector`, `CreateFilter`, `CreateIPSet`.
 41- Determine whether a replacement destination was configured before or after the deletion.
 42- Correlate with IAM changes that may have granted GuardDuty administrative access to the calling identity.
 43
 44### Response and remediation
 45
 46- If unauthorized, immediately re-create the publishing destination to restore findings export.
 47- Rotate credentials for the calling identity and review all actions taken by those credentials.
 48- Apply an SCP or IAM policy restricting `guardduty:DeletePublishingDestination` to a dedicated security operations role.
 49- Review GuardDuty member account configurations to confirm the action was not replicated across multiple accounts.
 50"""
 51references = [
 52    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeletePublishingDestination.html",
 53    "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/",
 54]
 55risk_score = 47
 56rule_id = "29901591-a2c9-4ac3-b1c9-36fd1df0f4c1"
 57setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. GuardDuty management events are logged by default."
 58severity = "medium"
 59tags = [
 60    "Domain: Cloud",
 61    "Platform: AWS",
 62    "Data Source: AWS CloudTrail",
 63    "Service: AWS GuardDuty",
 64    "Rule Type: Custom Query (KQL)",
 65    "Tactic: Defense Evasion",
 66    "Resources: Investigation Guide",
 67]
 68timestamp_override = "event.ingested"
 69type = "query"
 70
 71query = '''
 72data_stream.dataset: "aws.cloudtrail"
 73    and event.provider: "guardduty.amazonaws.com"
 74    and event.action: "DeletePublishingDestination"
 75    and event.outcome: "success"
 76'''
 77
 78[[rule.threat]]
 79framework = "MITRE ATT&CK"
 80[[rule.threat.technique]]
 81id = "T1562"
 82name = "Impair Defenses"
 83reference = "https://attack.mitre.org/techniques/T1562/"
 84[[rule.threat.technique.subtechnique]]
 85id = "T1562.001"
 86name = "Disable or Modify Tools"
 87reference = "https://attack.mitre.org/techniques/T1562/001/"
 88
 89[rule.threat.tactic]
 90id = "TA0005"
 91name = "Defense Evasion"
 92reference = "https://attack.mitre.org/tactics/TA0005/"
 93
 94[rule.investigation_fields]
 95field_names = [
 96    "@timestamp",
 97    "aws.cloudtrail.user_identity.arn",
 98    "aws.cloudtrail.user_identity.type",
 99    "user.name",
100    "event.action",
101    "event.outcome",
102    "aws.cloudtrail.request_parameters",
103    "source.ip",
104    "cloud.region",
105    "cloud.account.id",
106]