You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
+86-31Lines changed: 86 additions & 31 deletions
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,16 @@
2
2
creation_date = "2020/05/28"
3
3
integration = ["aws"]
4
4
maturity = "production"
5
-
updated_date = "2025/01/15"
5
+
updated_date = "2025/11/12"
6
6
7
7
[rule]
8
8
author = ["Elastic"]
9
9
description = """
10
-
Identifies the deletion of an Amazon GuardDuty detector. Upon deletion, GuardDuty stops monitoring the environment and
11
-
all existing findings are lost.
10
+
Detects the deletion of an Amazon GuardDuty detector. GuardDuty provides continuous monitoring for malicious or
11
+
unauthorized activity across AWS accounts. Deleting the detector disables this visibility, stopping all threat detection
12
+
and removing existing findings. Adversaries may delete GuardDuty detectors to impair security monitoring and evade
13
+
detection during or after an intrusion. This rule identifies successful "DeleteDetector" API calls and can indicate a
14
+
deliberate defense evasion attempt.
12
15
"""
13
16
false_positives = [
14
17
"""
@@ -17,64 +20,99 @@ false_positives = [
17
20
should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
18
21
""",
19
22
]
20
-
from = "now-60m"
23
+
from = "now-6m"
21
24
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
22
-
interval = "10m"
23
25
language = "kuery"
24
26
license = "Elastic License v2"
25
27
name = "AWS GuardDuty Detector Deletion"
26
28
note = """## Triage and analysis
27
29
28
30
> **Disclaimer**:
29
-
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
31
+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance.
32
+
> While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
30
33
31
34
### Investigating AWS GuardDuty Detector Deletion
32
35
33
-
AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior in AWS environments. Deleting a GuardDuty detector halts this monitoring, potentially concealing malicious actions. Adversaries may exploit this by deleting detectors to evade detection. The detection rule identifies successful deletion events, signaling potential defense evasion attempts, and is crucial for maintaining security visibility.
36
+
Amazon GuardDuty is a continuous threat detection service that analyzes CloudTrail, DNS, and VPC Flow Logs to identify malicious activity and compromised resources. Deleting a GuardDuty detector stops this monitoring entirely and permanently removes all historical findings for the affected AWS account. This rule detects successful `DeleteDetector` API calls, which may represent an attacker attempting to impair defenses and evade detection. Such actions should be rare and always performed under controlled administrative change processes.
34
37
35
-
### Possible investigation steps
38
+
#### Possible investigation steps
36
39
37
-
- Review the CloudTrail logs for the specific event.provider:guardduty.amazonaws.com and event.action:DeleteDetector to identify the user or role responsible for the deletion.
38
-
- Check the event.outcome:success to confirm the deletion was successful and not an attempted action.
39
-
- Investigate the IAM permissions and recent activity of the user or role identified to determine if the deletion was authorized or potentially malicious.
40
-
- Examine any recent GuardDuty findings prior to the deletion to assess if there were any critical alerts that might have prompted the deletion.
41
-
- Correlate the timing of the detector deletion with other security events or anomalies in the AWS environment to identify potential patterns or coordinated actions.
42
-
- Review AWS CloudTrail logs for any other suspicious activities or changes in the environment around the time of the detector deletion.
40
+
- **Identify the actor**
41
+
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to determine who initiated the deletion.
42
+
- Verify whether this principal normally performs GuardDuty configuration or administrative tasks.
43
+
44
+
- **Review request context**
45
+
- Check `aws.cloudtrail.request_parameters` and `cloud.region` to confirm the targeted GuardDuty detector and scope of impact.
46
+
- Determine whether multiple detectors or member accounts were affected (especially in delegated admin organizations).
47
+
48
+
- **Analyze source and access patterns**
49
+
- Review `source.ip`, `user_agent.original` and `source.geo` fields for anomalous or previously unseen access locations or automation clients.
50
+
- Check whether the deletion occurred outside standard maintenance windows or during a concurrent suspicious activity window.
51
+
52
+
- **Correlate with preceding or related activity**
53
+
- Search for earlier GuardDuty configuration changes:
54
+
- `StopMonitoringMembers`, `DisassociateMembers`, or `DeleteMembers`
55
+
- IAM role or policy modifications reducing GuardDuty privileges
56
+
- Look for other defense evasion indicators such as CloudTrail suspension, Security Hub configuration changes, or disabling of AWS Config rules.
57
+
58
+
- **Review historical GuardDuty findings**
59
+
- Examine prior GuardDuty alerts and findings (if still retrievable) to determine whether the deletion followed significant detection activity.
60
+
- Use centralized logs or security data lakes to recover findings removed from the console.
43
61
44
62
### False positive analysis
45
63
46
-
- Routine maintenance or administrative actions may lead to the deletion of a GuardDuty detector. Verify if the deletion aligns with scheduled maintenance or administrative tasks.
47
-
- Automated scripts or tools used for environment cleanup might inadvertently delete detectors. Review and adjust automation scripts to prevent unintended deletions.
48
-
- Organizational policy changes or restructuring could result in detector deletions. Ensure that policy changes are communicated and understood by all relevant teams to avoid unnecessary deletions.
49
-
- Exclude known and authorized users or roles from triggering alerts by creating exceptions for specific IAM roles or user accounts that are responsible for legitimate detector deletions.
50
-
- Implement logging and alerting for detector deletions to quickly identify and verify the legitimacy of the action, allowing for rapid response to potential false positives.
64
+
- **Authorized administrative actions**
65
+
- Verify whether the deletion corresponds to legitimate account decommissioning, region cleanup, or migration activity.
66
+
- **Automation or IaC**
67
+
- GuardDuty may be disabled temporarily during infrastructure provisioning or teardown in automated environments.
68
+
Confirm via CI/CD logs or Infrastructure-as-Code templates.
69
+
- **Organizational configuration changes**
70
+
- Large organizations might consolidate GuardDuty under a delegated administrator account, causing detectors to be deleted in member accounts.
71
+
Validate these actions against security architecture changes.
51
72
52
73
### Response and remediation
53
74
54
-
- Immediately re-enable GuardDuty in the affected AWS account to restore monitoring capabilities and ensure continuous threat detection.
55
-
- Conduct a thorough review of CloudTrail logs to identify any unauthorized access or suspicious activities that occurred during the period when GuardDuty was disabled.
56
-
- Isolate any compromised resources identified during the log review to prevent further unauthorized access or damage.
57
-
- Notify the security operations team and relevant stakeholders about the incident for awareness and further investigation.
58
-
- Implement additional access controls and monitoring on the AWS account to prevent unauthorized deletion of GuardDuty detectors in the future.
59
-
- Review and update IAM policies to ensure that only authorized personnel have permissions to delete GuardDuty detectors.
60
-
- Consider enabling AWS Config rules to monitor and alert on changes to GuardDuty configurations for proactive detection of similar incidents.
75
+
- **Containment and restoration**
76
+
- If unauthorized, immediately re-enable GuardDuty in the affected account and region using the `CreateDetector` API or AWS console.
77
+
- Verify that findings aggregation and member account associations are restored to expected configurations.
78
+
79
+
- **Investigation**
80
+
- Review CloudTrail for related privilege escalation or resource tampering events around the deletion time.
81
+
- Assess whether any attacker activity occurred during the monitoring gap between deletion and restoration.
61
82
62
-
## Setup
83
+
- **Recovery and hardening**
84
+
- Restrict `guardduty:DeleteDetector` permissions to a limited administrative role.
85
+
- Implement AWS Config rules or Security Hub controls to alert on changes to GuardDuty detectors or configuration states.
86
+
- Enforce least privilege IAM policies, ensuring operational automation cannot disable GuardDuty outside maintenance workflows.
87
+
- Document approved GuardDuty maintenance activities and correlate them with change tickets for traceability.
63
88
64
-
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
89
+
### Additional information
90
+
- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)**
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
0 commit comments