{"id":"d2656e78-c069-4571-8220-9e0ab5913f19","title":"AWS GuardDuty Detector Deleted Or Updated","description":"Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.\nUpon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.\nVerify with the user identity that this activity is legitimate.\n","author":"suktech24","status":"experimental","level":"high","date":"2025-11-27","modified":"","tags":["attack.defense-impairment","attack.t1685","attack.t1685.002"],"technique_ids":["T1685","T1685.002"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Legitimate detector deletion by an admin (e.g., during account decommissioning).","Temporary disablement for troubleshooting (verify via change management tickets).","Automated deployment tools (e.g. Terraform) managing GuardDuty state."],"references":["https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html","https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html","https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html","https://docs.datadoghq.com/security/default_rules/719-39f-9cd/","https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled","https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html","https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml","https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml","https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm","https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/","https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/","https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_guardduty_detector_deleted_or_updated.yml","source_sha256":"7a0a19ba3a9a9cd537f3fbc24e0510c3681a1b09108152ee3bf62d08b23e0668","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_guardduty_detector_deleted_or_updated.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS GuardDuty Detector Deleted Or Updated\nid: d2656e78-c069-4571-8220-9e0ab5913f19\nstatus: experimental\ndescription: |\n    Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.\n    Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.\n    Verify with the user identity that this activity is legitimate.\nreferences:\n    - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html\n    - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html\n    - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html\n    - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/\n    - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled\n    - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html\n    - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml\n    - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml\n    - https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm\n    - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/\n    - https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/\n    - https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion\nauthor: suktech24\ndate: 2025-11-27\ntags:\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.t1685.002\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_event_source:\n        eventSource: 'guardduty.amazonaws.com'\n    selection_action_delete:\n        eventName: 'DeleteDetector'\n    selection_action_update:\n        eventName: 'UpdateDetector'\n        requestParameters.enable: 'false'\n    selection_status_success:\n        errorCode: 'Success'\n    selection_status_null:\n        errorCode: null\n    condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_*\nfalsepositives:\n    - Legitimate detector deletion by an admin (e.g., during account decommissioning).\n    - Temporary disablement for troubleshooting (verify via change management tickets).\n    - Automated deployment tools (e.g. Terraform) managing GuardDuty state.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"},{"key":"enterprise/T1685.002","id":"T1685.002","name":"Disable or Modify Cloud Log","page":"techniques/enterprise/T1685.002/"}],"data_path":"data/detection-rules/d2656e78-c069-4571-8220-9e0ab5913f19.json","kind":"sigma"}