AWS GuardDuty Detector Deleted Or Updated

Nov 10, 2026 · attack.defense-impairment attack.t1685 attack.t1685.002 ·

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.

Sigma rule (View on GitHub)

 1title: AWS GuardDuty Detector Deleted Or Updated
 2id: d2656e78-c069-4571-8220-9e0ab5913f19
 3status: experimental
 4description: |
 5    Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
 6    Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
 7    Verify with the user identity that this activity is legitimate.    
 8references:
 9    - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html
10    - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html
11    - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html
12    - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/
13    - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled
14    - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html
15    - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml
16    - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
17    - https://web.archive.org/web/20251207042451/https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm
18    - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/
19    - https://web.archive.org/web/20251207021609/https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/
20    - https://github.com/redcanaryco/atomic-red-team/blob/a0e3f9bc69fed2fd711bd1f1aa87a40c33482fe6/atomics/T1685/T1685.md#atomic-test-49-aws---guardduty-suspension-or-deletion
21author: suktech24
22date: 2025-11-27
23tags:
24    - attack.defense-impairment
25    - attack.t1685
26    - attack.t1685.002
27logsource:
28    product: aws
29    service: cloudtrail
30detection:
31    selection_event_source:
32        eventSource: 'guardduty.amazonaws.com'
33    selection_action_delete:
34        eventName: 'DeleteDetector'
35    selection_action_update:
36        eventName: 'UpdateDetector'
37        requestParameters.enable: 'false'
38    selection_status_success:
39        errorCode: 'Success'
40    selection_status_null:
41        errorCode: null
42    condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_*
43falsepositives:
44    - Legitimate detector deletion by an admin (e.g., during account decommissioning).
45    - Temporary disablement for troubleshooting (verify via change management tickets).
46    - Automated deployment tools (e.g. Terraform) managing GuardDuty state.
47level: high

References

DeleteDetector - Amazon GuardDuty

Deletes an Amazon GuardDuty detector that is specified by the detector ID.

Read More
UpdateDetector - Amazon GuardDuty

Updates the GuardDuty detector specified by the detector ID.

Read More
Suspending or disabling GuardDuty - Amazon GuardDuty

Learn how you can suspend or disable Amazon GuardDuty, and also how you can re-enable it.

Read More
AWS GuardDuty detector deleted

Datadog, the leading service for cloud-scale monitoring.

Read More
AWS GuardDuty detector is not enabled misconfiguration detected in code | Cortex Documentation Portal

Enabling the AWS GuardDuty detector can help protect your Amazon Web Services (AWS) resources from various types of threats, such as malware, data breaches, and unauthorized access. GuardDuty is a ...

Read More
Sign in · Stellar Cyber Documentation

Customer documentation Stellar CyberKnowledge Base Product guides, release notes and API references for the Open XDR platform, available to customers and partners. To align with our security practi...

Read More
Azure-Sentinel/Solutions/Amazon Web Services/Analytic Rules/AWS_GuardDutyDisabled.yaml at master · Azure/Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise. - Azure/Azure-Sentinel

Read More
detection-rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml at main · elastic/detection-rules

Contribute to elastic/detection-rules development by creating an account on GitHub.

Read More
Wayback Machine

TIMESTAMPS The Wayback Machine - https://web.archive.org/web/20251207042451/https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm

Read More
Data Source: AWS CloudTrail DeleteDetector

Created: 2024-05-22 Last Updated: 2026-05-13 ID: 5d8bd475-c8bc-4447-b27f-efa508728b90 Author: Patrick Bareiss, Splunk Description Logs the deletion of an Amazon GuardDuty detector, including details about the detector ID and associated configurations. Details Property Value Source aws_cloudtrail Sourcetype aws:cloudtrail Separator eventName Related Detections Name ▲▼ Technique ▲▼ Type ▲▼ AWS Defense Evasion Impair Security Services Disable or Modify Cloud Log TTP Supported Apps Splunk Add-on for AWS (version 8.2.2) Event Fields + Fields _time app awsRegion aws_account_id command date_hour date_mday date_minute date_month date_second date_wday date_year date_zone dest dvc errorCode eventCategory eventID eventName eventSource eventTime eventType eventVersion eventtype host index linecount managementEvent msg object_category product punct readOnly recipientAccountId region requestID requestParameters.

Read More
AWS : Threat Detection Rule – GuardDuty detector disabled or suspended

Weekly #11-2025 – By suktech24, Thurs 17 July 2025, Estimated reading time : 10 mins In this week, I am diving into one threat detection rule : AWS GuardDuty detector disabled or suspended. Before …

Read More
atomic-red-team/atomics/T1685/T1685.md at a0e3f9bc69fed2fd711bd1f1aa87a40c33482fe6 · redcanaryco/atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

Read More

AWS GuardDuty Detector Deleted Or Updated

Sigma rule (View on GitHub)

References

Related rules