Elastic medium stable kql

AWS GuardDuty Publishing Destination Deleted

Detects the deletion of an Amazon GuardDuty publishing destination. Publishing destinations export GuardDuty findings to S3, Security Lake, or EventBridge for long-term retention and SIEM ingestion. An adversary with GuardDuty administrative access may delete a publishing destination to prevent findings from reaching external storage or a security operations center, reducing the visibility of their activity while leaving the GuardDuty detector active.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeletePublishingDestination"
    and event.outcome: "success"

False Positives

⚠ Decommissioning of a GuardDuty publishing destination during a planned security architecture migration may trigger this rule. Validate that the deletion is associated with a known infrastructure change and that an alternative destination was configured.

Field Validations

Loading…

Comments (0)

Loading comments...