AWS Security Hub Disabled

  1[metadata]
  2creation_date = "2026/08/24"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/24"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when AWS Security Hub is disabled in a region. Security Hub aggregates security findings from
 11AWS services (GuardDuty, Inspector, Macie, IAM Access Analyzer) and third-party tools into a single
 12pane of glass. Disabling it suppresses centralized finding aggregation and compliance checks, removing
 13visibility into threats across the account. This action is a documented pre-ransomware and
 14pre-exfiltration defense evasion technique.
 15"""
 16false_positives = [
 17    """
 18    Legitimate account decommissioning or cost-reduction exercises may disable Security Hub in
 19    unused regions. Validate with the responsible team via change management records before
 20    escalating. Disabling in the primary account region or the Security Hub delegated administrator
 21    account is always high-risk.
 22    """,
 23]
 24from = "now-6m"
 25index = ["logs-aws.cloudtrail-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "AWS Security Hub Disabled"
 29note = """## Triage and analysis
 30
 31### Investigating AWS Security Hub Disabled
 32
 33AWS Security Hub aggregates security findings from GuardDuty, Inspector, IAM Access Analyzer, Macie, and partner products. Disabling it is a one-API-call action (DisableSecurityHub) that immediately stops new findings from appearing in the hub and breaks compliance posture checks (CIS, PCI DSS, AWS Foundational Security Best Practices). Threat actors performing pre-ransomware activity commonly disable security services to reduce detection during the exfiltration and encryption phases.
 34
 35### Possible investigation steps
 36
 37- Identify the caller in aws.cloudtrail.user_identity.arn and user.name. Determine whether this is a human operator, a CI/CD service role, or an automated account lifecycle script.
 38- Check source.ip against known office CIDRs, VPN endpoints, and CI/CD runner IPs. A call from an unexpected geography or cloud provider IP is a strong indicator of credential compromise.
 39- Query CloudTrail for all API calls from this identity in the same time window. Look for co-occurring DeleteDetector or UpdateDetector with enable false (GuardDuty), DisableMacie or UpdateMacieSession with status PAUSED (Macie), DeleteTrail, StopLogging, PutEventSelectors (reducing event selectors), or DeleteFlowLogs calls — a multi-service security teardown is high confidence ransomware/wiperware preparation.
 40- Determine whether Security Hub was re-enabled shortly after (indicating a momentary operational toggle) or remained disabled.
 41- Check whether this corresponds to a known change window or approved infrastructure operation.
 42
 43### False positive analysis
 44
 45- Regional decommissioning: teams shutting down an AWS region may disable Security Hub as part of account cleanup. Validate against a change management ticket.
 46- Cost optimization: Security Hub has a cost per finding. Some teams disable it in non-production accounts. If this fires in a dev/test account with known cost controls, correlate with account tags.
 47
 48### Response and remediation
 49
 50- If unauthorized, re-enable Security Hub immediately and review all findings that were suppressed during the disabled period using the Security Hub finding history API.
 51- Revoke active sessions for the calling identity.
 52- Review other security services (GuardDuty, Macie, Inspector) to confirm they remain enabled.
 53- Enable AWS Config rule securityhub-enabled to detect future disablement automatically.
 54- If the caller was a compromised IAM user, rotate all access keys and review all actions in the compromised session.
 55"""
 56references = [
 57    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-disable.html",
 58]
 59risk_score = 47
 60rule_id = "c8a2d4f6-1b3e-4a7c-9d5f-8e0b2c6a4d1e"
 61setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. No additional CloudTrail data event selectors are required — `securityhub:DisableSecurityHub` is a management-plane API logged by default in any CloudTrail trail with management event logging enabled."
 62severity = "medium"
 63tags = [
 64    "Domain: Cloud",
 65    "Platform: AWS",
 66    "Data Source: AWS CloudTrail",
 67    "Service: AWS Security Hub",
 68    "Rule Type: Custom Query (KQL)",
 69    "Tactic: Defense Evasion",
 70    "Resources: Investigation Guide",
 71]
 72timestamp_override = "event.ingested"
 73type = "query"
 74
 75query = '''
 76data_stream.dataset: "aws.cloudtrail"
 77    and event.provider: "securityhub.amazonaws.com"
 78    and event.action: "DisableSecurityHub"
 79    and event.outcome: "success"
 80'''
 81
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85[[rule.threat.technique]]
 86id = "T1562"
 87name = "Impair Defenses"
 88reference = "https://attack.mitre.org/techniques/T1562/"
 89[[rule.threat.technique.subtechnique]]
 90id = "T1562.001"
 91name = "Disable or Modify Tools"
 92reference = "https://attack.mitre.org/techniques/T1562/001/"
 93
 94
 95[rule.threat.tactic]
 96id = "TA0005"
 97name = "Defense Evasion"
 98reference = "https://attack.mitre.org/tactics/TA0005/"
 99
100[rule.investigation_fields]
101field_names = [
102    "@timestamp",
103    "aws.cloudtrail.user_identity.arn",
104    "aws.cloudtrail.user_identity.type",
105    "aws.cloudtrail.user_identity.access_key_id",
106    "user.name",
107    "event.action",
108    "event.outcome",
109    "source.ip",
110    "cloud.region",
111    "cloud.account.id",
112]