AWS GuardDuty Publishing Destination Deleted

[metadata]
creation_date = "2026/08/14"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/14"

[rule]
author = ["Elastic"]
description = """
Detects the deletion of an Amazon GuardDuty publishing destination. Publishing destinations
export GuardDuty findings to S3, Security Lake, or EventBridge for long-term retention and
SIEM ingestion. An adversary with GuardDuty administrative access may delete a publishing
destination to prevent findings from reaching external storage or a security operations center,
reducing the visibility of their activity while leaving the GuardDuty detector active.
"""
false_positives = [
    """
    Decommissioning of a GuardDuty publishing destination during a planned security architecture
    migration may trigger this rule. Validate that the deletion is associated with a known
    infrastructure change and that an alternative destination was configured.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS GuardDuty Publishing Destination Deleted"
note = """## Triage and analysis

### Investigating AWS GuardDuty Publishing Destination Deleted

Amazon GuardDuty publishing destinations export threat findings to S3 buckets, Amazon Security Lake, or EventBridge buses for retention and downstream SIEM ingestion. Deleting a publishing destination severs this pipeline: findings still appear in the GuardDuty console but are no longer exported, making it harder for security operations to correlate GuardDuty alerts with other event sources.

This action is uncommon in production environments. Legitimate deletions occur during planned migrations to a new destination or when decommissioning GuardDuty in an account.

### Possible investigation steps

- Identify the caller from `aws.cloudtrail.user_identity.arn` and `user.name`. Verify this identity has a documented reason to modify GuardDuty configuration.
- Check `aws.cloudtrail.request_parameters` for the destination ID and detector ID. Query GuardDuty to confirm whether any publishing destination remains configured.
- Review CloudTrail for other GuardDuty control-plane actions by the same identity in the surrounding time window: `DeleteDetector`, `UpdateDetector`, `CreateFilter`, `CreateIPSet`.
- Determine whether a replacement destination was configured before or after the deletion.
- Correlate with IAM changes that may have granted GuardDuty administrative access to the calling identity.

### Response and remediation

- If unauthorized, immediately re-create the publishing destination to restore findings export.
- Rotate credentials for the calling identity and review all actions taken by those credentials.
- Apply an SCP or IAM policy restricting `guardduty:DeletePublishingDestination` to a dedicated security operations role.
- Review GuardDuty member account configurations to confirm the action was not replicated across multiple accounts.
"""
references = [
    "https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeletePublishingDestination.html",
    "https://hackingthe.cloud/aws/avoiding-detection/modify-guardduty-config/",
]
risk_score = 47
rule_id = "29901591-a2c9-4ac3-b1c9-36fd1df0f4c1"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. GuardDuty management events are logged by default."
severity = "medium"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS CloudTrail",
    "Service: AWS GuardDuty",
    "Rule Type: Custom Query (KQL)",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeletePublishingDestination"
    and event.outcome: "success"
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "user.name",
    "event.action",
    "event.outcome",
    "aws.cloudtrail.request_parameters",
    "source.ip",
    "cloud.region",
    "cloud.account.id",
]