AWS GuardDuty Threat Intelligence Set Deleted

Detects the deletion of an Amazon GuardDuty threat intelligence set. Threat intelligence sets are custom lists of known-malicious IP addresses or domains that GuardDuty uses to generate findings when monitored resources communicate with those indicators. Deleting a threat intel set degrades GuardDuty's detection capability for known adversary infrastructure, allowing communication with threat-actor-controlled IP ranges to go undetected.

Rule type: query
Rule indices:

  • logs-aws.cloudtrail-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-6m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Platform: AWS
  • Data Source: AWS CloudTrail
  • Service: AWS GuardDuty
  • Rule Type: Custom Query (KQL)
  • Tactic: Defense Evasion
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
The AWS integration must be ingesting management events into logs-aws.cloudtrail-*. GuardDuty management events are logged by default.

GuardDuty threat intelligence sets allow security teams to upload custom lists of known-malicious IP addresses and domains. GuardDuty generates high-priority findings when monitored resources contact addresses in these sets. Deleting a threat intel set reduces GuardDuty's ability to detect communication with known adversary infrastructure.

Legitimate deletions occur during feed rotation (replacing an old set with an updated version) or when decommissioning a threat intel feed. Both operations should be planned and documented.

  • Identify the caller from aws.cloudtrail.user_identity.arn and user.name.
  • Check aws.cloudtrail.request_parameters for the threat intel set ID and detector ID. Determine whether any threat intel sets remain active in the detector.
  • Review CloudTrail for adjacent GuardDuty control-plane modifications: CreateThreatIntelSet, UpdateThreatIntelSet, CreateIPSet, UpdateIPSet, DeleteDetector, CreateFilter.
  • Determine whether a replacement threat intel set was created before or after the deletion.
  • Correlate with other defense-evasion indicators such as GuardDuty detector updates or suppression rule creation.
  • Re-create or restore the threat intelligence set if the deletion was unauthorized.
  • Rotate credentials for the calling identity and review all actions taken by those credentials.
  • Apply an SCP or IAM policy restricting guardduty:DeleteThreatIntelSet to a dedicated security operations role.
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeleteThreatIntelSet"
    and event.outcome: "success"

Framework: MITRE ATT&CK