AWS GuardDuty Detector Deleted Or Updated

Status: experimental
Severity: high
Log source: product aws, service cloudtrail
Author: suktech24
Source: github.com/SigmaHQ/sigma

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.

Known false positives

Legitimate detector deletion by an admin (e.g., during account decommissioning).
Temporary disablement for troubleshooting (verify via change management tickets).
Automated deployment tools (e.g. Terraform) managing GuardDuty state.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteDetector`: Deletes an Amazon GuardDuty detector, disabling threat detection for the account in the current region.
AWS	CloudTrail event `UpdateDetector`: Updates an Amazon GuardDuty detector's configuration, such as enabling or disabling data sources or changing the finding publishing frequency.

Rules detecting the same action

These rules filter on the same operation.

AWS Defense Evasion Impair Security Services (Splunk)
AWS GuardDuty Detection Suppression (Elastic)
AWS GuardDuty Detector Deletion (Elastic)

Rule body

title: AWS GuardDuty Detector Deleted Or Updated
id: d2656e78-c069-4571-8220-9e0ab5913f19
status: experimental
description: |
    Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
    Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
    Verify with the user identity that this activity is legitimate.
references:
    - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html
    - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html
    - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html
    - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/
    - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled
    - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html
    - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml
    - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
    - https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm
    - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/
    - https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/
    - https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion
author: suktech24
date: 2025-11-27
tags:
    - attack.defense-impairment
    - attack.t1685
    - attack.t1685.002
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event_source:
        eventSource: 'guardduty.amazonaws.com'
    selection_action_delete:
        eventName: 'DeleteDetector'
    selection_action_update:
        eventName: 'UpdateDetector'
        requestParameters.enable: 'false'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_*
falsepositives:
    - Legitimate detector deletion by an admin (e.g., during account decommissioning).
    - Temporary disablement for troubleshooting (verify via change management tickets).
    - Automated deployment tools (e.g. Terraform) managing GuardDuty state.
level: high

Stages and Predicates

Stage 0: `condition`

selection_event_source and 1 of selection_action_* and 1 of selection_status_*

Stage 1: `selection_event_source`

selection_event_source:
    eventSource: 'guardduty.amazonaws.com'

Stage 2: `selection_action_delete`

selection_action_delete:
    eventName: 'DeleteDetector'

Stage 3: `selection_action_update`

selection_action_update:
    eventName: 'UpdateDetector'
    requestParameters.enable: 'false'

Stage 4: `selection_status_success`

selection_status_success:
    errorCode: 'Success'

Stage 5: `selection_status_null`

selection_status_null:
    errorCode: null

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`Success`	`field:"aws::errorCode" kind:eq value:"Success"`
`errorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`eventName`	eq	`DeleteDetector` `UpdateDetector`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`guardduty.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"guardduty.amazonaws.com"`
`requestParameters.enable`	eq	`false`	`field:"requestParameters.enable" kind:eq value:"false"`