AWS GuardDuty Threat Intelligence Set Deleted

  1[metadata]
  2creation_date = "2026/08/14"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the deletion of an Amazon GuardDuty threat intelligence set. Threat intelligence sets
 11are custom lists of known-malicious IP addresses or domains that GuardDuty uses to generate
 12findings when monitored resources communicate with those indicators. Deleting a threat intel set
 13degrades GuardDuty's detection capability for known adversary infrastructure, allowing
 14communication with threat-actor-controlled IP ranges to go undetected.
 15"""
 16false_positives = [
 17    """
 18    Removal of an outdated or inaccurate threat intelligence set during a scheduled feed
 19    rotation may trigger this rule. Confirm the deletion corresponds to a planned feed update
 20    and that a replacement set was activated.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-aws.cloudtrail-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "AWS GuardDuty Threat Intelligence Set Deleted"
 28note = """## Triage and analysis
 29
 30### Investigating AWS GuardDuty Threat Intelligence Set Deleted
 31
 32GuardDuty threat intelligence sets allow security teams to upload custom lists of known-malicious IP addresses and domains. GuardDuty generates high-priority findings when monitored resources contact addresses in these sets. Deleting a threat intel set reduces GuardDuty's ability to detect communication with known adversary infrastructure.
 33
 34Legitimate deletions occur during feed rotation (replacing an old set with an updated version) or when decommissioning a threat intel feed. Both operations should be planned and documented.
 35
 36### Possible investigation steps
 37
 38- Identify the caller from `aws.cloudtrail.user_identity.arn` and `user.name`.
 39- Check `aws.cloudtrail.request_parameters` for the threat intel set ID and detector ID. Determine whether any threat intel sets remain active in the detector.
 40- Review CloudTrail for adjacent GuardDuty control-plane modifications: `CreateThreatIntelSet`, `UpdateThreatIntelSet`, `CreateIPSet`, `UpdateIPSet`, `DeleteDetector`, `CreateFilter`.
 41- Determine whether a replacement threat intel set was created before or after the deletion.
 42- Correlate with other defense-evasion indicators such as GuardDuty detector updates or suppression rule creation.
 43
 44### Response and remediation
 45
 46- Re-create or restore the threat intelligence set if the deletion was unauthorized.
 47- Rotate credentials for the calling identity and review all actions taken by those credentials.
 48- Apply an SCP or IAM policy restricting `guardduty:DeleteThreatIntelSet` to a dedicated security operations role.
 49"""
 50references = [
 51    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteThreatIntelSet.html",
 52    "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/",
 53]
 54risk_score = 47
 55rule_id = "7ba46fa6-496c-4d62-a811-7c221b3d2dd9"
 56setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. GuardDuty management events are logged by default."
 57severity = "medium"
 58tags = [
 59    "Domain: Cloud",
 60    "Platform: AWS",
 61    "Data Source: AWS CloudTrail",
 62    "Service: AWS GuardDuty",
 63    "Rule Type: Custom Query (KQL)",
 64    "Tactic: Defense Evasion",
 65    "Resources: Investigation Guide",
 66]
 67timestamp_override = "event.ingested"
 68type = "query"
 69
 70query = '''
 71data_stream.dataset: "aws.cloudtrail"
 72    and event.provider: "guardduty.amazonaws.com"
 73    and event.action: "DeleteThreatIntelSet"
 74    and event.outcome: "success"
 75'''
 76
 77[[rule.threat]]
 78framework = "MITRE ATT&CK"
 79[[rule.threat.technique]]
 80id = "T1562"
 81name = "Impair Defenses"
 82reference = "https://attack.mitre.org/techniques/T1562/"
 83[[rule.threat.technique.subtechnique]]
 84id = "T1562.001"
 85name = "Disable or Modify Tools"
 86reference = "https://attack.mitre.org/techniques/T1562/001/"
 87
 88[rule.threat.tactic]
 89id = "TA0005"
 90name = "Defense Evasion"
 91reference = "https://attack.mitre.org/tactics/TA0005/"
 92
 93[rule.investigation_fields]
 94field_names = [
 95    "@timestamp",
 96    "aws.cloudtrail.user_identity.arn",
 97    "aws.cloudtrail.user_identity.type",
 98    "user.name",
 99    "event.action",
100    "event.outcome",
101    "aws.cloudtrail.request_parameters",
102    "source.ip",
103    "cloud.region",
104    "cloud.account.id",
105]