AWS GuardDuty Publishing Destination Deleted

Detects the deletion of an Amazon GuardDuty publishing destination. Publishing destinations export GuardDuty findings to S3, Security Lake, or EventBridge for long-term retention and SIEM ingestion. An adversary with GuardDuty administrative access may delete a publishing destination to prevent findings from reaching external storage or a security operations center, reducing the visibility of their activity while leaving the GuardDuty detector active.

Rule type: query
Rule indices:

  • logs-aws.cloudtrail-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-6m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Platform: AWS
  • Data Source: AWS CloudTrail
  • Service: AWS GuardDuty
  • Rule Type: Custom Query (KQL)
  • Tactic: Defense Evasion
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
The AWS integration must be ingesting management events into logs-aws.cloudtrail-*. GuardDuty management events are logged by default.

Amazon GuardDuty publishing destinations export threat findings to S3 buckets, Amazon Security Lake, or EventBridge buses for retention and downstream SIEM ingestion. Deleting a publishing destination severs this pipeline: findings still appear in the GuardDuty console but are no longer exported, making it harder for security operations to correlate GuardDuty alerts with other event sources.

This action is uncommon in production environments. Legitimate deletions occur during planned migrations to a new destination or when decommissioning GuardDuty in an account.

  • Identify the caller from aws.cloudtrail.user_identity.arn and user.name. Verify this identity has a documented reason to modify GuardDuty configuration.
  • Check aws.cloudtrail.request_parameters for the destination ID and detector ID. Query GuardDuty to confirm whether any publishing destination remains configured.
  • Review CloudTrail for other GuardDuty control-plane actions by the same identity in the surrounding time window: DeleteDetector, UpdateDetector, CreateFilter, CreateIPSet.
  • Determine whether a replacement destination was configured before or after the deletion.
  • Correlate with IAM changes that may have granted GuardDuty administrative access to the calling identity.
  • If unauthorized, immediately re-create the publishing destination to restore findings export.
  • Rotate credentials for the calling identity and review all actions taken by those credentials.
  • Apply an SCP or IAM policy restricting guardduty:DeletePublishingDestination to a dedicated security operations role.
  • Review GuardDuty member account configurations to confirm the action was not replicated across multiple accounts.
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeletePublishingDestination"
    and event.outcome: "success"

Framework: MITRE ATT&CK